Page 273 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
NIST's SSDF community profile adds AI-model-specific considerations to the broader secure-development framework. Include data, model, evaluation, release, integration, and response paths in scope.
Read the guide
Cloud-native zero trust shifts application policy toward user, application, and service identities. Inventory workload identities and enforce narrowly scoped service-to-service authorization across environments.
Read the guide
Containers package applications but depend on a broader system. Govern image origin, build evidence, registry access, runtime policy, host security, monitoring, and retirement as one lifecycle.
Read the checklist
Platform firmware is needed to boot and operate a system. Procurement and operations should address unauthorized change prevention, detection, supported recovery, and evidence of restoration.
Read the guide
NIST's minimum verification guidance describes multiple complementary techniques. Select, scope, and retain evidence from the techniques that address design, code, dependencies, and running behavior.
Read the checklist
IaaS, PaaS, and SaaS expose different components and administrative boundaries. Trace every important access decision to the identity, policy, service layer, owner, and evidence source that enforce it.
Read the guide
OAuth authorization-code flows need exact redirect URI matching and correctly enforced PKCE. Treat both as testable protocol controls across every client and authorization server.
Read the guide
A CI/CD pipeline carries source through build, test, package, and deployment operations. Protect each transition, identity, dependency, artifact, approval, and evidence record in the path.
Read the playbook
Microservices depend on APIs and shared architectural services. Define how each service authenticates, authorizes, discovers peers, protects traffic, limits load, records events, and fails.
Read the guide
A proxy-based service mesh can centralize important service-to-service functions. Govern its identity, trust, policy, telemetry, availability, bypass paths, and change control as production security infrastructure.
Read the checklist