07 - References
references', 'appsec', 'security', 'compliance']
07 - References
To further your understanding of DevSecOps, compliance, and security maturity, consult the following industry-standard resources and frameworks.
Frameworks and Maturity Models
- OWASP SAMM (Software Assurance Maturity Model):
- Official Website
- Use this to assess, formulate, and implement a strategy for software security integrated into an existing SDLC.
- BSIMM (Building Security In Maturity Model):
- Official Website
- A study of real-world software security initiatives.
Reference Architectures
- DoD DevSecOps Reference Architecture:
- DoD Enterprise DevSecOps Strategy Guide
- A highly comprehensive guide used by the US Department of Defense to build secure, hardened CI/CD pipelines.
- CNCF DevSecOps Whitepaper:
- Cloud Native Computing Foundation (CNCF)
- Details security lifecycle practices specifically for cloud-native applications and Kubernetes environments.
Vulnerability Scoring
- CVSS v4.0 Specification:
- FIRST.org CVSS v4.0
- The official specification document detailing how to calculate Base, Threat, and Environmental metrics.
- EPSS (Exploit Prediction Scoring System):
- FIRST.org EPSS
- An open, data-driven effort for estimating the probability that a software vulnerability will be exploited in the wild.
Tooling References
- Open Policy Agent (OPA): https://www.openpolicyagent.org/
- Kyverno: https://kyverno.io/
- Semgrep: https://semgrep.dev/
- Trivy: https://aquasecurity.github.io/trivy/