Packt+ | Advance your knowledge in tech

You're reading from Hands-On Security in DevOps Ensure continuous security, deployment, and delivery with DevSecOps

Product type Paperback

Published in Jul 2018

Publisher

ISBN-13 9781788995504

Length 356 pages

Edition 1st Edition

Concepts

DevOps

Author (1):

Hsu

Title Page

Packt Upsell

Contributors

Preface

1. DevSecOps Drivers and Challenges FREE CHAPTER

2. Security Goals and Metrics

3. Security Assurance Program and Organization

4. Security Requirements and Compliance

5. Case Study - Security Assurance Program

6. Security Architecture and Design Principles

7. Threat Modeling Practices and Secure Design

8. Secure Coding Best Practices

9. Case Study - Security and Privacy by Design

10. Security-Testing Plan and Practices

11. Whitebox Testing Tips

12. Security Testing Toolkits

13. Security Automation with the CI Pipeline

14. Incident Response

15. Security Monitoring

16. Security Assessment for New Releases

17. Threat Inspection and Intelligence

18. Business Fraud and Service Abuses

19. GDPR Compliance Case Study

20. DevSecOps - Challenges, Tips, and FAQs

1. Assessments

2. Other Books You May Enjoy

Index

Q: What testing tools are suggested for data privacy assessment?

Data life cycle	Testing key points	Suggested testing tools
Transmission of data	Ensure that the sensitive information is not transmitted by GET The secure communication protocol, such as TLS v1.2, SSH V2, SFTP, SNMP V3	SSLyze, NMAP, Wireshark
Storage of data	Check whether sensitive information is encrypted Check that the permissions of the files are properly configured	TruffleHog: https://github.com/dxa4481/truffleHog
Encryption of data	No uses of weak encryption algorithms, such as MD5, RC4, Jackfish, and Tripple DES	Code-scanning tools: https://github.com/floyd-fuh/crass/blob/master/grep-it.sh
Data access and auditing	Logging any sensitive data query CL permissions	AuthMatrix: https://github.com/SecurityInnovation/AuthMatrix
Removal of data	Check that there is no sensitive information in temp, exception files, and cookies Check any plain-text sensitive information in the memory and cache	GCORE WinHex: https://www...