Reference Registry — DevSecOps
Propósito
Esta nota estandariza las referencias para la rama DevSecOps.
Usala para: - mantener las notas DevSecOps vinculadas a fuentes primarias fuertes - ayudar a Codex a elegir referencias consistentes - evitar contenido DevSecOps vago sin respaldo de estándares - mantener la rama práctica y orientada a ingeniería
Regla de fuente de verdad
Para notas DevSecOps, este registry es la fuente de verdad primaria.
Usalo junto con:
- <a href="devsecops/index.html">DevSecOps Index</a>
- registries relacionados cuando una nota se superpone fuertemente con APIs, web security o attack surface
Política de selección de referencias
Prioridad de fuentes
- estándares oficiales y documentación primaria
- guía gubernamental o de fundación
- recursos OWASP de testing/verificación
- guías operacionales de alta señal
- fuentes secundarias solo cuando agregan valor claro
Target por nota
- mínimo 2 referencias
- ideal 3 referencias
Etiquetas
Usar: - Fundamental - Testing / Lab - Investigación / Deep Dive - Docs oficiales de herramienta
Mapa de temas DevSecOps
nist-ssdf
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: NIST SP 800-218 overview/news — https://csrc.nist.gov/Projects/ssdf - Fundamental: NIST SSDF project page — https://csrc.nist.gov/projects/ssdf
secure-by-design
Referencias preferidas: - Fundamental: CISA Secure by Design — https://www.cisa.gov/resources-tools/resources/secure-by-design - Fundamental: CISA Secure by Design principles and approaches PDF — https://www.cisa.gov/sites/default/files/2023-04/principles_approaches_for_security-by-design-default_508_0.pdf
asvs-as-dev-process-input
Referencias preferidas: - Fundamental: OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ - Fundamental: OWASP ASVS Cheat Sheet Index — https://cheatsheetseries.owasp.org/IndexASVS.html
supply-chain-security
Referencias preferidas: - Fundamental: OWASP Software Supply Chain Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: CISA Secure by Design — https://www.cisa.gov/resources-tools/resources/secure-by-design
dependency-risk
Referencias preferidas: - Fundamental: OWASP Software Supply Chain Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final
artifact-integrity
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: OWASP Software Supply Chain Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html
ci-cd-hardening
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: CISA Secure by Design — https://www.cisa.gov/resources-tools/resources/secure-by-design - Fundamental: OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/
branch-protection-and-release-controls
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: CISA Secure by Design — https://www.cisa.gov/resources-tools/resources/secure-by-design
secrets-management
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: OWASP Software Supply Chain Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html - Fundamental: OWASP Secrets Management Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
container-security
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: CISA Secure by Design — https://www.cisa.gov/resources-tools/resources/secure-by-design
image-scanning
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: OWASP Software Supply Chain Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html
sbom-and-provenance
Referencias preferidas: - Fundamental: NIST SP 800-218 SSDF — https://csrc.nist.gov/pubs/sp/800/218/final - Fundamental: CISA Secure by Design — https://www.cisa.gov/resources-tools/resources/secure-by-design - Fundamental: OWASP Software Supply Chain Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html
Reglas de uso del registry
- elegí el set más chico de referencias fuertes para la nota exacta
- preferí estándares y guía primaria por encima de contenido genérico de blogs
- mantené las notas DevSecOps enfocadas en workflow de ingeniería y diseño de controles