Sadogursky, Baruch, About the Authors
SAST (see static application security testing)
scalability
HorizontalPodAutoscaler, Best Practices for Monitoring, Logging, and Tracing
documentation online, Best Practices for Monitoring, Logging, and Tracing
Kubernetes deployments, Deploying to Kubernetes
microservices versus monoliths, Serverless
serverless approach, Serverless
VerticalPodAutoscaler, Best Practices for Monitoring, Logging, and Tracing
scalable pixels (sp), Building for Disparate Screens
scheduling affected by security, Effects on Scheduling
scopes of dependencies (Maven), Dependency Management with Apache Maven, Dependency Management with Apache Maven
configuration in Gradle, Dependency Management with Gradle
scratch command in Dockerfile, Intro to Container Anatomy
screen size disparity in mobile devices, Building for Disparate Screens-Building for Disparate Screens
SDKMAN!, Microservice Frameworks
SecMs (security managers), Shift Security Left
attacker’s point of view, The Attacker’s Point of View
code review, Methods of Evaluation
OWASP Security Champions versus, Shift Security Left
secrets protected, Protect Your Secrets
security
about, Securing Your Binaries
about DevOps, Integrity, Authentication, and Availability
analysis
compliance, Compliance issues
compliance versus vulnerabilities, Compliance Versus Vulnerabilities
how much is enough, How Much Is Enough?
make or buy, Make or Buy
time to market, Time to Market
vulnerabilities, Vulnerabilities
Common Vulnerability Scoring System
about, The Common Vulnerability Scoring System
basic metrics, CVSS Basic Metrics
environmental metrics, CVSS Environmental Metrics
implementation, CVSS in Practice
temporal metrics, CVSS Temporal Metrics
DevOps infrastructure
about, Securing Your DevOps Infrastructure
rise of DevSecOps, The Rise of DevSecOps
site reliability engineers, The Role of SREs in Security
dynamic application security testing, Dynamic Application Security Testing-Disadvantages of DAST, SAST, DAST, IAST, and RASP Summary
runtime versus, Runtime Application Self-Protection, SAST, DAST, IAST, and RASP Summary
static versus, Comparing SAST and DAST, SAST, DAST, IAST, and RASP Summary
expertise availability, The Right Contact Person
full impact graph of vulnerabilities, The Full Impact Graph
interactive application security testing, Interactive Application Security Testing, SAST, DAST, IAST, and RASP Summary
runtime versus, Runtime Application Self-Protection, SAST, DAST, IAST, and RASP Summary
iOS App Store, Case Study: iOS App Store
metadata considerations, Metadata Considerations, Determining the Metadata
need for continuous updates, Why Everyone Needs Continuous Updates
Open Web Application Security Project, Static Application Security Testing
Security Champions, Shift Security Left
top 10 most common threats, Advantages of DAST, Shift Security Left, Advanced Training on Secure Coding
quality gate method
about, Quality Gate Methodology
definition of done, Milestones for Quality
flexible quality strategy, Quality gates as a flexible quality strategy
implementing, Implementing Security with the Quality Gate Method
not reviews or milestones, Quality gates as a flexible quality strategy
practical application, Practical Applications of Quality Management
project management, Fit with Project Management Procedures
risk management, Risk Management in Quality Gates
uniform quality guideline, Quality gates as uniform quality guideline
responsibility for, Be Aware of Responsibility
runtime application self-protection, Runtime Application Self-Protection
SAST, DAST, IAST versus, SAST, DAST, IAST, and RASP Summary
secure code versus clean code, Not All Clean Code Is Secure Code
security managers, Shift Security Left
security paradox, Shift Security Left
shift left, Shift Security Left-Shift Security Left
best practices, Shift Security Left-Be Aware of Responsibility
SolarWinds cyberattack, Supply Chain Security Compromised
customer perspective, Security from the Customer Perspective
vendor perspective, Security from the Vendor Perspective
static application security testing, Static Application Security Testing, SAST, DAST, IAST, and RASP Summary
advantages, Advantages of the SAST approach
dynamic versus, Comparing SAST and DAST, SAST, DAST, IAST, and RASP Summary
runtime versus, Runtime Application Self-Protection, SAST, DAST, IAST, and RASP Summary
training on, Advanced Training on Secure Coding
vulnerabilities
about timeline, Vulnerabilities: Timeline from Inception Through Production Fix
combined into attack vectors, Vulnerabilities Can Be Combined into Different Attack Vectors
compliance versus, Compliance Versus Vulnerabilities
creation of, Creation of a vulnerability
discovery of, Vulnerabilities, Discovery of the vulnerability
fixing in production, Fixing the vulnerability in production
public availability of, Public availability of the vulnerability
test coverage, Test Coverage Is Your Safety Belt
security managers (SecMs), Shift Security Left
attacker’s point of view, The Attacker’s Point of View
code review, Methods of Evaluation
OWASP Security Champions versus, Shift Security Left
self-healing of Kubernetes, Best Practices for Monitoring, Logging, and Tracing
serverless approach to microservices, Serverless
billing information for FaaS, Setting Up
function as a service, Serverless-Setting Up
setting up FaaS, Setting Up-Setting Up
Service (Kubernetes), Local Setup for Deployment
ClusterIP Deployment and Service resource, Generate Kubernetes Manifests by Using Dekorate
service mesh control planes, Choose and Implement a Deployment Strategy, Best Practices for Monitoring, Logging, and Tracing
service uptime, Continuous Uptime
(see also continuous uptime)
service-level indicators (SLIs), High Availability and Geographic Distribution
service-level objectives (SLOs), High Availability and Geographic Distribution
service-oriented architecture (SOA), Microservices
service-to-service communication control, Choose and Implement a Deployment Strategy
Shafer, Andrew Clay, Foreword
Simple Logging Facade for Java (SLF4J), Logging
site reliability engineering (SRE)
bridging Dev and Ops, Done and Done
definition of SRE, We All Got the Message
failure budget, The Role of SREs in Security
rate, errors, duration (RED), Tracing
role of site reliability engineer, The Role of SREs in Security
today’s definition of “done”, Done and Done
SLF4J (Simple Logging Facade for Java), Logging
SmallRye Health extension, Setting Up Health Checks
smartphone workflows
about, Mobile Workflows-Mobile Workflows
continuous updates, Mobile Workflows
(see also continuous deployment)
Android device fragmentation
about, Android Device Fragmentation
hardware and 3D support, Hardware and 3D Support-Hardware and 3D Support
OS fragmentation, Android
OS Fragmentation
screen size disparity, Building for Disparate Screens-Building for Disparate Screens
benefits to business, Fast-Paced DevOps Workflows for Mobile
continuous testing on parallel devices
about, Continuous Testing on Parallel Devices
device farm, Building a Device Farm-Building a Device Farm
mobile device clouds, Mobile Pipelines in the Cloud-Microsoft Visual Studio App Center
strategy for device testing, Planning a Device-Testing Strategy-Planning a Device-Testing Strategy
deployment, Fast-Paced DevOps Workflows for Mobile
DevOps stages, Fast-Paced DevOps Workflows for Mobile
SNAPSHOT tag, Capturing Metadata
software as a service (SaaS)
about, Cloud Computing, Continuous Uptime
case study: Cloudflare, Case Study: Cloudflare
2013 router rule outage, 2013 Cloudflare router rule outage
2019 bad regex outage, 2019 Cloudflare regex outage
2020 backbone outage, 2020 Cloudflare backbone outage
continuous uptime, Continuous Uptime
software craftsmanship manifesto, If We’re Not About Deployment and Operations, Then Just What Is Our Job?
SolarWinds cyberattack, Supply Chain Security Compromised
customer perspective, Security from the Customer Perspective
vendor perspective, Security from the Vendor Perspective
Sonatype Nexus Repository, Publishing to Maven Central
publishing to, Publishing to Sonatype Nexus Repository
source code management (SCM)
about, The System of Truth
Git as de facto standard, Three Generations of Source Code Management, Choosing Your Source Control-Choosing Your Source Control
metadata about, Determining the Metadata
three generations of, Three Generations of Source Code Management-Three Generations of Source Code Management
Sourcetree Git client (Atlassian), Git Clients
span in tracing, Tracing
Spectre vulnerability exploit, Widespread chipset vulnerabilities
Spring Boot, Spring Boot-Spring Boot
about implementation, Microservice Frameworks
Java versus GraalVM Native Image, Microservice Frameworks
Actuator
health checks, Setting Up Health Checks
metrics, Monitoring-Monitoring
GraalVM Native Image mode, Spring Boot-Spring Boot
Greeting.java, Spring Boot, Helidon
GreetingController.java, Spring Boot
Java mode, Spring Boot, Spring Boot
Spring Initializr, Spring Boot
Spring Framework, Spring Boot
SRE (see site reliability engineering)
StatefulSet (Kubernetes), Managing Workloads in Kubernetes
static application security testing (SAST), Static Application Security Testing, SAST, DAST, IAST, and RASP Summary
advantages, Advantages of the SAST approach
dynamic versus, Comparing SAST and DAST, SAST, DAST, IAST, and RASP Summary
runtime versus, Runtime Application Self-Protection, SAST, DAST, IAST, and RASP Summary
static contract pitfall, Antipatterns
storage of images via layers, Leveraging layer cache
Subversion (Apache), Three Generations of Source Code Management
switch (Git command), Git Command-Line Basics
system dependency scope, Dependency Management with Apache Maven
system properties link, Determining the Metadata
system-on-a-chip (SoC) manufacturers of mobile hardware, Android
OS Fragmentation