Secure Coding - Ensuring Safe Deployment of Code

We'll talk about the basic security principles and outline where we're headed in this section.

Authentication is "Who Are You?", and Authorization is "What Can You Do?" We'll walk through some examples and implementations of those two ideas.

We'll move to some nuts and bolts and talk about how communications are secured with public key infrastructure.

With basic PKI under our belts, we'll look at certificates, the primary artifact used in executing secure communications.

We'll put our theory into practice by encrypting and decrypting a message, and look at some of the other operations involved in secure transfers.

We'll take a quick look back at what we've covered in this section.

We'll talk about how security has to be woven in from the start, not bolted on at the end.

We'll learn about the very cornerstone of all security, the principle of least privilege.

We'll look at a number of examples of where Least Privilege is not employed, and the bad stuff that ensues.

We'll talk about securing our work against the inside job of a disgruntled employee.

We'll examine the concept of Defense in Depth - what it means, and how to make it happen.

We'll talk about the necessary measure of performing background checks and gathering information about the people working with secure data.

We'll talk about the often overlooked topic of physically securing the workplaces and infrastructure where our digital work is performed.

We'll use a medium complexity DevOps process and how to make it secure with security policies.

We'll take a quick look back at what we've covered in this section.

We'll talk about the role of a build in DevOps, and what "secure builds" means.

We'll take a look at build agent security, along with a way to take very fine control of the security of our agent.

We'll look at some best practices for creating security in our builds.

We'll look at a build with static analysis of source code using my favorite tool.

Passwords and secure assets are unavoidable - we'll talk about how to handle them securely.

Getting our tools to talk to each other is critical; we'll talk about how this works in light of PKI.

We'll take a close look at two ways of establishing authentication and authorization trust between two tools.

We'll look at Single-Sign On (SSO) from two perspectives, and the nuts and bolts of how it works.

We'll talk about the security implications of all those packages we rely on as DevOps professionals.

We'll take a quick look back at what we've covered in this section.

We'll discuss the two facets of deployment security - deploying securely, and deploying to infrastructure that is maintained securely.

We'll talk about the ultimate deployment pattern, Immutable Server, and how it enables DevOps security.

We'll talk about containers, and what the use of containers in our infrastructure means for security.

We'll look at a simple SQL Server database running in a container, and look at how we can maintain the security of containers.

We'll ask the question "How can containers be kept secure?" and answer it with some container and VM principles.

We'll talk about the role of configuration in our code, how to minimize it, and what that means for keeping our work secure.

Here at the end of the section, we'll address the more narrow question of how to deploy code securely against interception.

We'll take a quick look back at what we've covered in this section.

We'll get philosophical, for just a minute, about the nature of chaos and security.

We'll talk about why the house of a hoarder cannot be secure, and demonstrate the value of wargaming a logging strategy.

We'll use the bread and butter tool of a security engineer, regular expressions, to identify the signature of an attack in a web log.

We'll talk about the ultimate approach to making your logs observable, with ELK Stack and tools like it.

We'll talk about what it is that is important to log from a security standpoint, and how to do it without getting sensitive information into the logs.

We'll take a quick look back at what we've covered in this section.

We'll break down the big ideas we covered in the course, and a take a moment to look at how they work together.