Book Image

Accelerate DevOps with GitHub

By : Michael Kaufmann
Book Image

Accelerate DevOps with GitHub

By: Michael Kaufmann

Overview of this book

This practical guide to DevOps uses GitHub as the DevOps platform and shows how you can leverage the power of GitHub for collaboration, lean management, and secure and fast software delivery. The chapters provide simple solutions to common problems, thereby helping teams that are already on their DevOps journey to further advance into DevOps and speed up their software delivery performance. From finding the right metrics to measure your success to learning from other teams’ success stories without merely copying what they’ve done, this book has it all in one place. As you advance, you’ll find out how you can leverage the power of GitHub to accelerate your value delivery – by making work visible with GitHub Projects, measuring the right metrics with GitHub Insights, using solid and proven engineering practices with GitHub Actions and Advanced Security, and moving to event-based and loosely coupled software architecture. By the end of this GitHub book, you'll have understood what factors influence software delivery performance and how you can measure your capabilities, thus realizing where you stand in your journey and how you can move forward.
Table of Contents (31 chapters)
1
Part 1: Lean Management and Collaboration
7
Part 2: Engineering DevOps Practices
14
Part 3: Release with Confidence
19
Part 4: Software Architecture
22
Part 5: Lean Product Management
25
Part 6: GitHub for your Enterprise

Dynamic application security testing

To harden your application security, you can integrate dynamic application security testing (DAST) into your release workflow. DAST is black-box testing that simulates a real-world attack on the running application.

There are many commercial tools and SaaS solutions (such as Burp Suit from PortSwigger or WhiteHat Sentinel) but it's outside the scope of this book to analyze them.

There are also some open source solutions. One example is the Zed Attack Proxy (ZAP) (https://www.zaproxy.org/) from OWASP. It's a stand-alone application that runs on Windows, macOS, and Linux (see https://www.zaproxy.org/download/) and can be used to attack web applications. The application allows you to analyze a web application, intercept and modify traffic, and run an attack using the ZAP Spider against the website or parts of it (see Figure 15.7):

Figure 15.7 – The OWASP ZAP application

OWASP ZAP launches a browser and...