DevSecOps School

Introduction & Overview What is Trivy? Trivy is an open-source vulnerability scanner developed by Aqua Security, designed to identify security issues in container images, Kubernetes clusters, file systems, code repositories, and Infrastructure as Code (IaC) configurations. Known for its simplicity, speed, and comprehensive scanning capabilities, Trivy is a go-to tool for DevSecOps teams aiming to…

Introduction & Overview What is Checkov? Checkov is an open-source static code analysis tool designed to scan Infrastructure as Code (IaC) files for security vulnerabilities, misconfigurations, and compliance issues. Developed by Bridgecrew (now part of Palo Alto Networks’ Prisma Cloud), Checkov supports multiple IaC frameworks, including Terraform, CloudFormation, Kubernetes, Helm, and more. It integrates seamlessly…

Introduction & Overview What is SonarQube? SonarQube is an open-source platform for continuous inspection of code quality. It enables development teams to detect bugs, vulnerabilities, code smells, and maintain high standards in software projects. Through static code analysis, it provides detailed reports and dashboards to monitor code health across over 30 programming languages, including Java,…

Introduction & Overview What is Burp Suite? Burp Suite is a Java-based platform developed by PortSwigger for web application security testing and penetration testing. It provides a comprehensive toolkit to identify vulnerabilities, analyze HTTP/HTTPS traffic, and ensure web application security. Available in Community, Professional, and Enterprise editions, it caters to individual pentesters, security teams, and…

Introduction & Overview What is OWASP ZAP? OWASP ZAP (Zed Attack Proxy) is an open-source, free-to-use web application security testing tool maintained by the Open Web Application Security Project (OWASP). It is designed to identify vulnerabilities in web applications during development, testing, and deployment phases. ZAP acts as an intercepting proxy, capturing HTTP/HTTPS traffic between…

Introduction & Overview Web Application Firewalls (WAFs) are critical components in modern cybersecurity, protecting web applications from threats like SQL injection, cross-site scripting (XSS), and other OWASP Top Ten vulnerabilities. In the context of DevSecOps, WAFs bridge development, security, and operations by embedding security controls into the software development lifecycle (SDLC). This tutorial provides a…

Introduction & Overview What is Fluentd? Fluentd is an open-source data collection and logging tool designed to unify the logging layer across diverse systems. It collects, processes, and forwards log data from various sources to multiple destinations, acting as a flexible and scalable log aggregator. Written primarily in Ruby, Fluentd is lightweight, extensible, and supports…

Introduction & Overview Syslog is a standard protocol for message logging, widely used in IT systems to collect, store, and analyze log data from various sources. In the context of DevSecOps, Syslog plays a critical role in enhancing visibility, ensuring security, and maintaining compliance across the software development lifecycle. This tutorial provides an in-depth exploration…