Answer: DevSecOps integrates security practices, tooling, and automated scanning directly into every phase of the standard software development lifecycle (SDLC), rather than treating security audits as an afterthought before release.

Answer:

• SAST (Static Application Security Testing): Analyzes source code or binaries without executing them (White-box testing) to identify coding errors, vulnerabilities, and credential leaks early.
• DAST (Dynamic Application Security Testing): Analyzes a running application from the outside (Black-box testing) to discover runtime vulnerabilities, authentication weaknesses, and injection flaws.
• IAST (Interactive Application Security Testing): Combines SAST and DAST by executing inside the application runtime using instrumented agents, analyzing code paths and inputs in real-time.

Answer: Dependency Scanning analyzes project dependency lockfiles (e.g., package-lock.json, go.sum) to match package versions against known vulnerability databases (like CVE databases), alerting if code imports libraries containing security issues.

Answer: An SBOM (Software Bill of Materials) is a machine-readable nested inventory listing all software components, third-party libraries, dependencies, and license details utilized to build an application, allowing teams to track CVE exposures.

Answer: Supply Chain Security is the practice of securing the entire software lifecycle from development to deployment. This includes verifying the integrity of base images, securing CI/CD pipelines, signing commits, auditing dependencies, and protecting registry storage against unauthorized access.

Answer:

• CVE (Common Vulnerabilities and Exposures): A standardized, unique identifier assigned to publicly disclosed cybersecurity vulnerabilities (e.g., CVE-2021-44228 for Log4j).
• CVSS (Common Vulnerability Scoring System): A numerical rating system (ranging from 0.0 to 10.0) that measures the severity of a vulnerability based on exploitability, impact, and complexity.

Answer: Container Scanning checks container images (typically using tools like Trivy, Clair, or Grype) for vulnerabilities inside operating system libraries, base filesystems, and packages installed within the image.

Answer:

1. Storage: Save secrets in a centralized manager (AWS Secrets Manager, HashiCorp Vault).
2. Automation: Write a serverless function (e.g., Lambda) triggered periodically (e.g., every 30 days).
3. Rotation workflow:
   • Create a new credential version in the target system (e.g., database).
   • Update the secret manager database key.
   • Test connection using the new credentials.
   • Deprecate the old credentials.

Answer:

1. RBAC: Enforce strict Least Privilege role mappings.
2. Network Policies: Restrict pod communication.
3. Secrets Encryption: Encrypt etcd storage at rest.
4. PSS: Apply Pod Security Standards (restricting root containers).
5. Control Plane hardening: Restrict access to the API server IP.

Answer: CIS (Center for Internet Security) Benchmarks are globally recognized, consensus-based best practice guidelines used to configure and audit security settings for operating systems, cloud environments (AWS, Azure), and container orchestration platforms (Kubernetes).

Answer: The OWASP Top 10 is a regularly updated report representing the ten most critical security vulnerabilities affecting web applications (e.g., SQL injections, broken authentication, cryptographic failures, and server-side request forgery).

Answer: Image Signing uses cryptographic key pairs (e.g., using Cosign) to sign a container image after building it. The deployment target (e.g., Kubernetes via a validating webhook) verifies the signature before running the container, ensuring that only trusted, unmodified images run in production.