DevSecOps Foundation flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shift left

Moving security activities earlier in the software lifecycle, such as threat modeling at design and scanning at commit, so defects are found when remediation is cheapest and fastest.

Cost of delay curve

The principle that remediation cost rises sharply the later a defect is discovered, from design through development, testing, production, and post-breach response.

DORA four keys

Deployment frequency, lead time for change, change failure rate, and time to restore service. These measure delivery performance and are used to judge whether security controls help or hinder flow.

Security debt

Accumulated unremediated security weaknesses, such as outdated dependencies or missing controls, that persist across releases and compound in cost and risk over time.

Blameless postmortem

A structured review after an incident that examines the conditions, decisions, and system factors that allowed failure, without punishing individuals, so recurrence is prevented.

Security champion

An engineer embedded in a product team who owns threat modeling, triage, and security guidance for that team, with dedicated time and a defined reporting relationship.

Psychological safety

A team climate in which people can report mistakes, near misses, and uncertainty without fear of punishment, which makes defect and incident data trustworthy.

Shared ownership model

An arrangement where product teams own the security risk of their services while a central security function owns standards, tooling, and specialist incident response.

Pilot-first rollout

An adoption strategy that instruments one high-value, low-coupling service end to end, measures outcomes, and then replicates the proven pattern across the organization.

Tool sprawl

Accumulation of overlapping security scanners without owners or triage paths, which produces unactioned findings and consumes developer time without reducing risk.

Risk-based prioritization

Ranking findings by exploitability, exposure, and asset criticality rather than raw severity score, so remediation effort targets the weaknesses most likely to cause harm.

Compensating control

An alternative safeguard that reduces risk when a primary control cannot be applied, such as network segmentation around a legacy system that cannot be rebuilt.

Defense in depth

Layering preventive, detective, and corrective controls so that failure or bypass of any single control does not result in full compromise of the system.

STRIDE

A threat modeling mnemonic covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, applied per data flow and trust boundary.

Least privilege

Granting each identity, service, and pipeline agent only the permissions required for its specific function, for only as long as required, to limit blast radius.

Artifact provenance

Verifiable evidence of where a build artifact came from and how it was produced, including source commit, builder identity, and signed attestation, used to defend the supply chain.

Authentication versus authorization

Authentication establishes who a subject is; authorization determines which actions that subject may perform; accounting independently records what was actually done.

Phishing-resistant MFA

Authentication factors bound to the legitimate origin, such as FIDO2 security keys or passkeys, which resist real-time relay attacks that one-time codes do not stop.

OpenID Connect

An identity layer built on OAuth 2.0 that authenticates users and issues an ID token containing verified claims about the subject, alongside the access token.

Just-in-time elevation

Granting privileged access for a bounded window after approval, with full logging and automatic expiry, instead of standing administrator rights.

SAST

Static application security testing that analyzes source or bytecode without executing the program, finding code-level flaws early but producing false positives and missing runtime configuration issues.

DAST

Dynamic application security testing that probes a running application from outside, finding runtime and configuration weaknesses but lacking code context and coverage of unexercised paths.

Software composition analysis

A scan that inventories third-party components and libraries and maps them to known vulnerability records and license obligations, covering dependencies rather than first-party code.

Secret scanning

Automated inspection of commits and repository history for credentials and keys; a positive finding requires immediate revocation because the value is already exposed.

Immutable infrastructure

A model in which servers and containers are replaced rather than modified in place, eliminating configuration drift and making rollback and audit deterministic.

Infrastructure as code scanning

Static analysis of declarative infrastructure definitions before they are applied, detecting misconfigured storage, network, and identity settings prior to deployment.

Default-deny networking

A segmentation posture in which all ingress and egress traffic is blocked unless an explicit allow rule permits it, limiting lateral movement after an initial compromise.

Patch SLA

A defined maximum time to remediate a vulnerability by severity level, tracked as mean time to patch, with an exception process for cases that cannot meet it.

Policy as code

Expressing security and compliance requirements as version-controlled, executable rules evaluated automatically in pipelines, producing continuous and reproducible evidence.

Risk register

A maintained record of identified risks, each with an owner, likelihood and impact rating, treatment decision, and review date, used to steer remediation and acceptance.

Control mapping

Linking each technical control or automated check to the framework requirements it satisfies, so one implementation can evidence multiple standards and avoid duplicate audits.

Risk acceptance

A documented decision to tolerate a known risk, with an accountable approver, a stated rationale, any compensating control, and a mandatory expiry date for review.

Centralized log shipping

Forwarding security-relevant events off the originating host to a restricted, append-only central store, so an attacker with host access cannot erase the evidence trail.

Detection as code

Managing alerting rules in version control, testing them against known-bad samples, and assigning owners, so detection logic is reviewable, tunable, and reproducible.