Cyber Wiki Topic 10

Cloud, Application Security & DevSecOps

Cloud responsibility, secure software, APIs, pipelines, application risk, and modern platforms.

Topic Directory

157 entries

AI Connector and Plugin Security

AI connector and plugin security governs integrations that let models read data or act through external applications and services.

AI delivery controls · Advanced

AI Deployment Approval Gates

AI deployment approval gates require defined evidence and accountable authorization before models or AI-enabled features advance into higher-risk environments.

AI assurance engineering · Intermediate

AI Evaluation Pipelines

AI evaluation pipelines run repeatable tests against model quality, safety, security, fairness, robustness, and operational requirements.

MLOps security · Advanced

AI Model Serving Security

AI model serving security protects inference endpoints, runtimes, dependencies, model access, scaling, and operational telemetry.

Generative AI application security · Intermediate

AI Output Validation

AI output validation treats generated text, code, commands, queries, and structured data as untrusted until the consuming system verifies it.

API security concept · Advanced

API Authentication and Token Validation

API authentication and token validation establish which principal is calling an API and whether the presented credential is authentic, current, intended for that audience, and permitted to support the requested action.

Application architecture concept · Advanced

API Gateway Security

An API gateway is an intermediary that routes and mediates API traffic and may enforce authentication, rate limits, schema controls, observability, transformation, and policy; securing it requires consistent edge policy without assuming the gateway can replace backend authorization.

API security · Advanced

API-Based Data Ingestion Security

API-based data ingestion security validates the source, identity, authorization, format, rate, and integrity of data accepted through programmatic interfaces.

ATT&CK mitigation profile · Intermediate

Application Developer Guidance (M1013)

Give developers actionable security requirements and patterns that reduce vulnerabilities before software reaches production. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Governance practice · Intermediate

Application Security Governance

Application security governance connects engineering work to risk ownership, secure design expectations, delivery controls, exceptions, evidence, and operational accountability.

Software supply chain · Advanced

Artifact Repository Integrity

Artifact repository integrity protects packages, containers, models, and build outputs from unauthorized replacement, deletion, downgrade, or ambiguous reuse.

Secure automation · Advanced

Automation Blast-Radius Control

Automation blast-radius control limits the systems, accounts, data, regions, and actions a script, pipeline, agent, or remediation job can affect.

Software supply chain · Intermediate

Automation Dependency Pinning

Automation dependency pinning fixes packages, images, modules, actions, and providers to reviewed versions or immutable digests instead of accepting unbounded future changes.

Automation engineering · Intermediate

Automation Idempotency

Automation idempotency means repeated execution against the same desired state produces the same acceptable result without accumulating unintended changes.

Secure automation · Intermediate

Automation Input Validation

Automation input validation verifies type, format, range, origin, authorization, and business rules before data can drive scripts, APIs, templates, or infrastructure changes.

Secure automation · Intermediate

Automation Output Validation

Automation output validation checks that generated files, API responses, model output, commands, and change plans conform to expected structure and permitted effects before downstream use.

Source control security · Advanced

Branch Protection Governance

Branch protection governance enforces review, status checks, signed or attributable changes, restricted force operations, and controlled exceptions on important source branches.

Application security concept · Intermediate

Broken Object-Level Authorization

Broken Object-Level Authorization is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Software supply chain · Advanced

Build Provenance Attestation

Build provenance attestation is verifiable metadata describing what produced an artifact, from which inputs, under what process, and in which build environment.

DevSecOps practice · Advanced

CI/CD Pipeline Security

CI/CD pipeline security protects source, build services, runners, credentials, dependencies, artifacts, approvals, and deployment paths used to deliver software.

Application architecture · Advanced

Cloud API Management

Cloud API management publishes, secures, observes, versions, and governs interfaces used by applications, partners, and services.

Governance structure · Intermediate

Cloud Account and Resource Hierarchy

Cloud account and resource hierarchies organize tenants, organizations, accounts, subscriptions, projects, folders, resource groups, and resources into manageable administrative boundaries.

Governance framework · Intermediate

Cloud Adoption Frameworks

Cloud adoption frameworks organize the strategy, people, governance, platform, security, migration, and operations work required to adopt cloud services deliberately.

Assurance practice · Advanced

Cloud Audit Evidence

Cloud audit evidence demonstrates how cloud controls are designed and operating through configuration, logs, assessments, access reviews, provider reports, tickets, approvals, and automated test results.

Operational practice · Intermediate

Cloud Automation and Orchestration

Cloud automation performs repeatable tasks through code and APIs, while orchestration coordinates multiple automated steps into a controlled workflow.

Resilience practice · Intermediate

Cloud Backup and Recovery

Cloud backup and recovery preserve restorable copies of data, configuration, and system state so services can recover after error, attack, corruption, or loss.

Financial control · Beginner

Cloud Budgets and Cost Allocation

Cloud budgets and cost allocation connect consumption to accountable teams, products, environments, and business purposes.

Technology model · Beginner

Cloud Computing

Cloud computing delivers configurable computing resources as on-demand services over a network, with rapid provisioning, measured use, and shared provider infrastructure.

Configuration risk · Intermediate

Cloud Configuration Drift

Cloud configuration drift occurs when deployed resources no longer match approved definitions, baselines, or intended architecture.

Platform security practice · Intermediate

Cloud Container Security

Cloud container security protects images, registries, orchestrators, nodes, runtime configuration, network policy, secrets, identities, and workloads throughout the container lifecycle.

Security architecture · Advanced

Cloud Control Plane Security

The cloud control plane contains the APIs, consoles, identities, and orchestration functions used to create and change cloud resources.

Audit control · Intermediate

Cloud Control-Plane Logging

Cloud control-plane logging records administrative and API actions that create, change, or delete cloud resources and policies.

Financial management practice · Beginner

Cloud Cost Management

Cloud cost management plans, allocates, monitors, and optimizes consumption-based technology spending while preserving required performance, security, and resilience.

Cloud identity risk · Advanced

Cloud Credential Exposure Paths

Cloud credential exposure paths include source code, build systems, images, logs, metadata services, environment variables, local files, browser sessions, and overprivileged automation.

Data governance practice · Intermediate

Cloud Data Classification and Discovery

Cloud data classification and discovery identify where sensitive or regulated information exists and apply handling rules according to value, harm, and obligation.

Data architecture · Intermediate

Cloud Data Lakes, Warehouses, and Analytics

Cloud analytics platforms combine object storage, warehouses, catalogs, transformation services, and query engines to process data at scale.

Audit and detection control · Advanced

Cloud Data-Access Logging

Cloud data-access logging records reads, writes, deletes, queries, exports, and sharing actions involving stored or managed data.

Architecture and data-protection practice · Advanced

Cloud Data-Plane Security

Cloud data-plane security protects the operations that read, write, process, transmit, and delete workload and business data after cloud resources have been configured.

Data security practice · Intermediate

Cloud Database Security

Cloud database security protects managed and self-managed data stores through identity, network access, encryption, configuration, auditing, backup, patching, and data governance.

Cloud service concept · Intermediate

Cloud Database Services

Cloud database services provide relational, key-value, document, graph, cache, and other data models with varying levels of provider management.

Cloud concept · Beginner

Cloud Deployment Models

Cloud deployment models describe how cloud infrastructure is owned, shared, located, and connected across public, private, community, and hybrid environments.

Architecture concept · Intermediate

Cloud Edge Computing

Cloud edge computing places processing, caching, networking, or service delivery closer to users, devices, or data sources than a central cloud region.

Network security control · Advanced

Cloud Egress Control

Cloud egress control limits and monitors outbound communication from workloads, users, and services to reduce exfiltration, command-and-control, and unauthorized dependency risk.

Architecture concept · Beginner

Cloud Elasticity and Scalability

Scalability is the ability to support increased demand by adding capacity, while elasticity is the ability to adjust that capacity quickly as demand changes.

Resilience and supplier-management practice · Advanced

Cloud Exit Planning

Cloud exit planning defines how an organization can move, replace, or retire cloud services while preserving data, evidence, continuity, security, and legal obligations.

Architecture practice · Advanced

Cloud Fault Tolerance

Cloud fault tolerance enables a system to continue performing required functions when components or dependencies fail.

Governance practice · Intermediate

Cloud Governance

Cloud governance establishes decision rights, policies, ownership, guardrails, evidence, and review processes for using cloud services in line with business and risk objectives.

Preventive and detective control · Intermediate

Cloud Guardrails

Cloud guardrails are centrally defined controls that prevent, constrain, detect, or remediate unsafe configurations while allowing teams to work within approved boundaries.

Architecture practice · Intermediate

Cloud High Availability

Cloud high availability uses redundant components, failure isolation, health detection, and automated recovery to keep a service accessible despite expected faults.

Identity architecture · Intermediate

Cloud Identity Federation

Cloud identity federation allows an external identity provider to authenticate users or workloads and provide trusted assertions or tokens to cloud services.

Cloud security practice · Intermediate

Cloud Identity and Access Management

Cloud identity and access management governs human and workload access to provider consoles, APIs, resources, data, secrets, and administrative functions.

Software supply-chain control · Intermediate

Cloud Image Security

Cloud image security protects virtual-machine and container images from vulnerable packages, malware, embedded secrets, untrusted changes, and unauthorized distribution.

Cloud workload security practice · Advanced

Cloud Instance Metadata Security

Cloud instance metadata security protects workload identity and configuration services that can expose temporary credentials or sensitive context to code running on a compute resource.

Cryptographic control · Intermediate

Cloud Key Management

Cloud key management governs the creation, storage, protection, use, rotation, recovery, and destruction of cryptographic keys used by cloud services and workloads.

Platform architecture · Intermediate

Cloud Landing Zones

A cloud landing zone is a governed foundation for accounts or subscriptions, identity, networking, logging, policy, security services, and workload onboarding.

Operational control · Intermediate

Cloud Logging and Monitoring

Cloud logging and monitoring collect, protect, correlate, and analyze events from identities, control planes, networks, workloads, applications, data services, and security tools.

Transformation practice · Intermediate

Cloud Migration Strategies

Cloud migration strategies define how an application, platform, or data set will move from its current environment into a cloud service or a new cloud operating model.

Security weakness · Intermediate

Cloud Misconfiguration

Cloud misconfiguration is an unsafe setting in identity, networking, storage, logging, encryption, compute, data, or organizational policy that creates unintended exposure or weakens control.

Governance architecture · Advanced

Cloud Multi-Account Strategy

A cloud multi-account strategy separates workloads, environments, teams, and control functions into distinct accounts, subscriptions, or projects with centralized governance.

Network security control · Intermediate

Cloud Network Segmentation

Cloud network segmentation separates workloads and services into controlled communication zones to limit exposure and lateral movement.

Infrastructure concept · Intermediate

Cloud Networking

Cloud networking connects workloads, services, users, data centers, and the internet through software-defined networks, routes, gateways, load balancers, name services, and provider backbones.

Data security practice · Intermediate

Cloud Object Storage Security

Cloud object storage security protects buckets, containers, objects, metadata, access policies, sharing links, encryption, versioning, and lifecycle settings.

Financial concept · Beginner

Cloud Pricing and Purchasing Models

Cloud pricing models charge for measured consumption and may offer on-demand, committed-use, reserved-capacity, spot, subscription, license-included, or dedicated options.

Network architecture · Intermediate

Cloud Private Connectivity

Cloud private connectivity creates controlled paths between users, data centers, cloud networks, and managed services without exposing traffic directly through public endpoints.

Access-control practice · Advanced

Cloud Privileged Access

Cloud privileged access governs identities and sessions capable of changing high-impact cloud configuration, identity, logging, networking, data protection, or organizational policy.

Infrastructure concept · Beginner

Cloud Regions and Availability Zones

Cloud regions and availability zones divide provider infrastructure into geographic and failure-isolated locations for deployment, resilience, latency, and data-governance decisions.

Operational capability · Intermediate

Cloud Resilience

Cloud resilience is the ability to prepare for, withstand, recover from, and adapt to disruption while preserving important services and acceptable outcomes.

Data and identity control · Intermediate

Cloud Secrets Management

Cloud secrets management protects passwords, API keys, tokens, certificates, and other sensitive values needed by applications and automation.

Security operations capability · Intermediate

Cloud Security Posture Management

Cloud security posture management continuously evaluates cloud resources and configurations against security baselines, architecture rules, and compliance requirements.

Operational concept · Intermediate

Cloud Service Quotas and Capacity

Cloud service quotas limit the number, rate, size, or regional availability of resources and API operations.

Cloud concept · Beginner

Cloud Service and Deployment Models

Cloud service models describe which layers a provider manages, while deployment models describe how cloud resources are owned, shared, and connected.

Contract and service concept · Intermediate

Cloud Service-Level Agreements

A cloud service-level agreement defines provider commitments and remedies for specified aspects of service availability or performance.

Cloud security model · Beginner

Cloud Shared Responsibility

Shared responsibility explains how cloud providers and customers divide security duties, while the customer remains accountable for understanding and operating its part of the service.

Data lifecycle concept · Beginner

Cloud Storage Classes and Lifecycle Policies

Cloud storage classes balance availability, access speed, durability, retrieval delay, and price for different patterns of data use.

Data management control · Intermediate

Cloud Storage Lifecycle and Versioning

Cloud storage lifecycle and versioning manage how data copies are created, retained, transitioned, archived, recovered, and deleted over time.

Data service concept · Beginner

Cloud Storage Models

Cloud storage commonly uses object, block, and file models, each with different access patterns, performance characteristics, durability options, and security controls.

Data architecture · Advanced

Cloud Streaming Data Pipelines

Streaming data pipelines ingest and process events continuously for analytics, monitoring, automation, and application integration.

Architecture and governance concern · Intermediate

Cloud Sustainability

Cloud sustainability considers the environmental effects of computing demand, resource efficiency, hardware utilization, data movement, software design, and service location.

Detection capability · Advanced

Cloud Threat Detection

Cloud threat detection identifies suspicious behavior across identities, control planes, workloads, networks, storage, and managed services.

Defensive planning practice · Advanced

Cloud Threat-Informed Defense

Cloud threat-informed defense prioritizes controls and detections according to the ways adversaries actually abuse cloud identities, APIs, services, configurations, and data paths.

Security operations practice · Intermediate

Cloud Vulnerability Management

Cloud vulnerability management identifies, prioritizes, and reduces exploitable weaknesses across images, hosts, containers, functions, applications, libraries, services, and configuration.

Architecture framework · Intermediate

Cloud Well-Architected Frameworks

Cloud well-architected frameworks provide structured principles and review questions for evaluating reliability, security, operations, performance, cost, and sustainability decisions.

Identity control · Intermediate

Cloud Workload Identities

Cloud workload identities let applications, services, virtual machines, containers, and automation authenticate without sharing human accounts or embedding permanent secrets.

ATT&CK mitigation profile · Intermediate

Code Signing (M1045)

Use cryptographic signatures and trusted publishing processes to verify software origin and integrity before execution or deployment. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Container security · Intermediate

Container Network Security

Container network security controls service exposure, east-west communication, port publishing, name resolution, administrative planes, and traffic policy across container hosts and clusters.

Software supply chain practice · Advanced

Container Registry and Image Security

Container image security protects the build, storage, distribution, approval, and use of container images.

Container security · Intermediate

Container Runtime Isolation

Container runtime isolation constrains containers through namespaces, cgroups, capabilities, syscall controls, user separation, and hardened runtime configuration rather than assuming an image boundary is sufficient.

Cloud security concept · Intermediate

Container Runtime Security

Container Runtime Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Container security · Intermediate

Container Volume Security

Container volume security protects persistent and host-mounted data by controlling ownership, labels, mount modes, secret placement, backup behavior, and the host paths a workload may reach.

Browser security control · Advanced

Content Security Policy

Content Security Policy is an HTTP response policy that tells supporting browsers which sources and execution patterns are permitted for scripts, styles, images, frames, connections, and other resources, reducing the impact of many content-injection flaws.

Web session-security concept · Intermediate

Cookies and Web Sessions

Cookies are browser-managed name-value records scoped by domain, path, security attributes, and lifetime; web applications often use them to carry a session identifier that binds requests to server-side authentication and authorization state.

Application security concept · Intermediate

Cross-Site Request Forgery

Cross-Site Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Application security concept · Intermediate

Cross-Site Scripting

Cross-Site Scripting is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Cloud data security · Advanced

Data Lakehouse Security

Data lakehouse security applies consistent identity, governance, classification, encryption, isolation, and audit controls across open files, metadata catalogs, compute engines, and analytic tables.

Data engineering security · Advanced

Data Pipeline Security

Data pipeline security protects the identities, code, connectors, queues, transformations, storage locations, and orchestration used to move data between systems.

Change management · Intermediate

Database Schema Change Control

Database schema change control governs how tables, fields, constraints, indexes, and dependent code are proposed, tested, deployed, and reversed.

Database engineering · Advanced

Database Transaction Isolation

Transaction isolation defines how concurrent database operations can observe or interfere with one another and which anomalies an application is willing to accept.

Data engineering security · Intermediate

ETL and ELT Security

ETL and ELT security governs how extraction, transformation, and loading jobs handle privileges, staging areas, code, secrets, quality checks, and sensitive data.

Cloud concept · Beginner

Essential Characteristics of Cloud Computing

The essential characteristics of cloud computing describe the operating behaviors that distinguish cloud services from ordinary hosting.

MLOps governance · Intermediate

Experiment Tracking and Versioning

Experiment tracking and versioning connect hypotheses, datasets, code, parameters, environments, metrics, artifacts, reviewers, and decisions for analytic and machine-learning work.

AI data security · Advanced

Feature Store Security

Feature-store security protects reusable machine-learning features, definitions, historical values, serving paths, and access policies across training and inference.

Application security concept · Intermediate

File Upload Security

File Upload Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Operating model · Intermediate

FinOps

FinOps is a collaborative operating practice that brings engineering, finance, product, procurement, and leadership together to maximize the business value of cloud spending.

Application security testing · Intermediate

Fuzz Testing

Fuzz testing sends generated, mutated, malformed, or unexpected inputs to software to reveal crashes, hangs, memory errors, state problems, and unsafe behavior.

DevSecOps governance · Intermediate

GitOps Security

GitOps security treats version-controlled declarations and automated reconciliation as a production control plane that requires protected repositories, signed changes, policy checks, and trustworthy deployment identities.

API security concept · Advanced

GraphQL Security

GraphQL security protects a typed query interface in which clients select fields and traverse relationships; the server must enforce authorization, resource limits, safe resolver behavior, and controlled schema exposure for every requested object and field.

Web protocol foundation · Foundational

HTTP Methods and Status Codes

HTTP methods express the intended action on a resource, while status codes communicate the outcome; secure applications enforce authorization and state rules for every method and return responses that are accurate without disclosing unnecessary detail.

Deployment pattern · Advanced

Immutable Infrastructure

Immutable infrastructure replaces deployed components with newly built versions instead of modifying them in place.

Software assurance practice · Advanced

Independent Verification and Validation

Independent verification and validation evaluates whether software was built correctly and whether it satisfies its intended needs, with sufficient separation from the team responsible for delivery.

AI application security · Advanced

Inference API Security

Inference API security protects model-serving interfaces against unauthorized use, abuse, extraction, privacy attacks, resource exhaustion, and unsafe input or output handling.

Infrastructure as code · Advanced

Infrastructure State Management

Infrastructure state management records the relationship between declared resources and real deployed objects so automation can plan changes safely.

Engineering practice · Intermediate

Infrastructure as Code

Infrastructure as code defines cloud and platform resources through machine-readable, version-controlled declarations or programs rather than ad hoc manual configuration.

Infrastructure as code · Advanced

Infrastructure-as-Code Policy Enforcement

Infrastructure-as-code policy enforcement evaluates proposed configurations against security, compliance, resilience, cost, and architecture rules before and after deployment.

Automation security · Intermediate

Infrastructure-as-Code State Security

Infrastructure-as-code state security protects the files, backends, locks, credentials, and metadata used to compare declared infrastructure with real resources and plan changes.

Application security concept · Intermediate

Insecure Deserialization

Insecure Deserialization is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Platform security practice · Advanced

Kubernetes Security

Kubernetes security protects the cluster control plane, nodes, workloads, images, network paths, secrets, and administrative interfaces.

AI engineering security · Advanced

MLOps Security

MLOps security protects the pipelines, repositories, registries, features, models, identities, approvals, and deployment mechanisms used across the machine-learning lifecycle.

Security practice · Intermediate

Managed Cloud Service Security

Managed cloud services shift infrastructure and operational tasks to the provider while leaving customers responsible for configuration, identities, data, integrations, and appropriate use.

Threat analysis technique · Intermediate

Misuse and Abuse Cases

Misuse and abuse cases describe how a system could be intentionally misused, manipulated, or driven into unsafe behavior.

Mobile security foundation · Intermediate

Mobile Application Architecture

Mobile application architecture combines device code, operating-system services, local storage, backend APIs, identity providers, push services, update channels, and third-party SDKs; security depends on how trust and data move across all of those components.

Architecture and governance practice · Advanced

Multi-Cloud Security

Multi-cloud security governs identity, data, networking, workloads, monitoring, and operations across services from more than one cloud provider.

Developer workspace security · Intermediate

Notebook Security

Notebook security protects interactive analytic environments against unauthorized access, secret exposure, untrusted code, unsafe outputs, uncontrolled packages, and accidental publication.

Operational technology architecture · Advanced

OT Edge and Cloud Integration

OT edge and cloud integration moves data, analytics, management, and sometimes control-related functions across boundaries that must preserve safety, autonomy, latency, trust, and recoverability.

Service management · Intermediate

PCI Cloud Scoping

PCI cloud scoping identifies payment-data flows, cloud resources, management planes, identities, services, providers, regions, logging, and shared responsibilities that store, process, transmit, or affect account-data security.

Service management · Intermediate

PCI E-Commerce Payment Page Security

PCI e-commerce payment page security protects the scripts, content, headers, integrations, and change paths that can influence how a customer’s browser captures or transmits payment data.

Service management · Intermediate

PCI Software Security Framework

The PCI Software Security Framework establishes security expectations for payment software and its lifecycle, including secure design, development, testing, release, vulnerability management, and ongoing maintenance.

Service management · Intermediate

Payment Page Script Inventory

A payment page script inventory records each script authorized to execute in the consumer’s browser, including source, owner, purpose, integrity, dependencies, approval, and monitoring status.

DevSecOps controls · Advanced

Pipeline Approval Gates

Pipeline approval gates prevent code, infrastructure, models, or configuration from advancing until required automated checks and accountable human decisions are satisfied.

Governance engineering practice · Advanced

Policy as Code

Policy as code expresses security, compliance, architecture, and operational rules in machine-evaluable form so they can be tested and enforced consistently.

Source control security · Intermediate

Pre-Commit Secret Detection

Pre-commit secret detection identifies likely credentials and sensitive values before they enter repository history, while server-side controls provide a second enforcement layer.

Software supply-chain security · Intermediate

Python Dependency Isolation

Python dependency isolation separates project packages and interpreters from system components so version conflicts, unreviewed libraries, and installation side effects do not spread across workloads.

Application security concept · Intermediate

REST API Security

REST API Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Application defense concept · Advanced

Runtime Application Protection

Runtime application protection observes and constrains application behavior while software is executing.

Application security · Intermediate

SQL Injection Prevention

SQL injection prevention keeps untrusted input from changing the structure or intent of database commands.

Automation resilience · Advanced

Safe Retry and Backoff

Safe retry and backoff controls repeat transiently failed operations without creating duplicate effects, resource exhaustion, synchronized storms, or indefinite execution.

Application security concept · Intermediate

Same-Origin Policy and Cross-Origin Resource Sharing

Same-Origin Policy and Cross-Origin Resource Sharing is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Application security practice · Intermediate

Secrets Management

Secrets management controls the creation, storage, distribution, use, rotation, revocation, and auditing of passwords, tokens, API keys, certificates, and cryptographic material.

Cloud security concept · Intermediate

Secure Access Service Edge

Secure Access Service Edge is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Application security testing · Intermediate

Secure Code Review

Secure code review examines source and related configuration for weaknesses in logic, trust, data handling, authorization, error paths, and use of dangerous APIs.

AI development security · Advanced

Secure Fine-Tuning

Secure fine-tuning adapts a pretrained model while controlling training data, code, adapters, permissions, evaluation, and release lineage.

Lifecycle practice · Intermediate

Secure Software Decommissioning

Secure software decommissioning removes an application or service while protecting data, credentials, dependencies, integrations, records, and users throughout retirement.

Application security practice · Intermediate

Secure Software Deployment

Secure software deployment moves approved software into an environment using controlled identities, verified artifacts, protected configuration, rollback capability, and observable change.

Development practice · Intermediate

Secure Software Development Lifecycle

A secure software development lifecycle integrates security requirements, design analysis, implementation practices, testing, release controls, and operational feedback throughout delivery.

Application security practice · Intermediate

Secure Software Requirements

Secure software requirements translate risk, policy, misuse cases, compliance, and design objectives into testable conditions for a system and its development process.

Release management · Intermediate

Semantic Versioning as Risk Communication

Semantic versioning communicates whether a release is intended to preserve compatibility, add compatible capability, or introduce breaking change.

Application security concept · Intermediate

Server-Side Request Forgery

Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Serverless security practice · Advanced

Serverless Event Trigger Security

Serverless event trigger security protects the queues, topics, schedules, storage events, webhooks, API routes, and other sources that invoke functions or workflows.

Application security practice · Advanced

Serverless Security

Serverless security protects event-driven functions and managed compute services by controlling code, identities, triggers, data, dependencies, and runtime behavior.

Secure automation · Intermediate

Shell Script Security

Shell script security reduces command injection, unsafe expansion, silent failure, secret exposure, and destructive mistakes through disciplined quoting, input handling, error checks, permissions, and review.

Software supply-chain control · Advanced

Software Artifact Signing and Provenance

Artifact signing proves that a trusted identity approved a specific software artifact, while provenance records describe how, where, and from what inputs it was built.

Software supply-chain artifact · Intermediate

Software Bill of Materials

A software bill of materials is a structured inventory of components and relationships included in a software product or build.

ATT&CK mitigation profile · Intermediate

Software Configuration (M1054)

Configure applications and services to minimize unnecessary features, unsafe defaults, excessive privileges, and exposed administrative functions. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Continuity and supplier-risk arrangement · Intermediate