DevSecOps

A collection of 36 posts

Lessons from Lapsus - CISO on Building a comprehensive secrets management program

Lessons from Lapsus - CISO on Building a comprehensive secrets management program

Following a breach by the Lapsus$ cyber gang, Jason Haddix, then CISO of UbiSoft called over 40 other CISOs to discuss strategies on how to be more resilient to attacks. Those conversations led him to create a 4 step guide to building a comprehensive secrets management program.

Platform Engineering and Security: A Very Short Introduction

Platform Engineering and Security: A Very Short Introduction

Is DevOps really dead? Learn about the rise of platform engineering and how it differs from DevOps in terms of self-service capabilities and automation. Discover how security fits into this new paradigm and the benefits of platform engineering for software development teams of various sizes.

How to Handle AWS Secrets

How to Handle AWS Secrets

In this blog post, we'll cover some best practices for managing AWS secrets when using the AWS SDK in Python.

How to Handle Secrets in Python

How to Handle Secrets in Python

DevOps engineers must handle secrets with care. In this series, we summarize best practices for leveraging secrets with your everyday tools.

Honeytokens - Protect Your Holy Grail

Honeytokens - Protect Your Holy Grail

When protecting your SDLC, you must choose. But choose wisely. For as the True Grail will bring you life. The False Grail will take it from you.

Securing The New Frontier in Developer Environments: Cloud IDEs

Securing The New Frontier in Developer Environments: Cloud IDEs

You might already be using a Cloud IDE for certain projects. This exciting evolution of the local dev environment has a lot of advantages but also brings some new risks. This article will help you stay safe as you embrace the cloud for your coding needs.

It Takes a Team to Solve Hardcoded Secrets

It Takes a Team to Solve Hardcoded Secrets

We’re introducing a new Role-based Access Management (RBAC) system with “Teams” in your GitGuardian Internal Monitoring workspace. Bring Dev, Sec, and Ops together and fix hardcoded credentials faster than you ever thought possible!

4 Reasons MSPs Should Monitor Their GitHub Footprint

4 Reasons MSPs Should Monitor Their GitHub Footprint

In recent years, resorting to MSPs has become very popular for companies wanting to accelerate the digitization of their businesses. With this surge in popularity, MSPs now face the question: how to ensure we can meet our cybersecurity responsibilities?

DevSecOps and the AppSec Shared Responsibility Model

DevSecOps and the AppSec Shared Responsibility Model

In their latest white paper, GitGuardian examines why implementing DevSecOps at scale to protect the modern software factory means evolving traditional AppSec. Read more to learn how the shared responsibility model adoption will unlock security in an agile world.

CI Pipelines: 5 Risks to Assess

CI Pipelines: 5 Risks to Assess

More and more parts of the software development process can occur without human intervention. However, this is not without its drawbacks. To keep your code and secrets safe, you should add the following security practices to your CI pipeline.

Hunting for secrets in Docker Hub: what we’ve found

Hunting for secrets in Docker Hub: what we’ve found

In this article, we will explain why Docker images can contain sensitive information and give some examples of the type of secrets we found in public Docker images. Finally, we will compare our results to the ones we have with source code scanning.

Shift your CI to GitHub Actions

Shift your CI to GitHub Actions

Learn how to build a modern CI pipeline using GitHub Actions to achieve testing, building, and pushing Docker images. Harden your pipeline by scanning for leaked secrets and credentials with the help of GitGuardian's gg-shield action.

Why SAST + DAST can't be enough

Why SAST + DAST can't be enough

Static and dynamic app testing are cornerstones for any comprehensive AppSec program, yet they rarely rise up to the challenges of fully securing modern software. Discover why secrets are one of their critical blind spots.

arrow-down