DevOps and Security - DevSecOps
monperrus opened this issue · comments
Wikipedia references:
- https://en.wikipedia.org/wiki/Information_security
- https://en.wikipedia.org/wiki/Information_security_audit
- https://en.wikipedia.org/wiki/Attribute-based_access_control
- https://en.wikipedia.org/wiki/Penetration_test
- https://en.wikipedia.org/wiki/Intrusion_detection_system
- https://en.wikipedia.org/wiki/Runtime_application_self-protection
- https://en.wikipedia.org/wiki/Dynamic_application_security_testing
- https://en.wikipedia.org/wiki/Supply_chain_attack
Principles:
- Complete Mediation Principle (useful for APIs)
- Least privileged
Intrusion detection: https://en.wikipedia.org/wiki/Intrusion_detection_system
(signature based, anomaly detection)
Very good set of pointers: https://www.sqreen.io/checklists/devops-security-checklist
Mapping security design principles to devops on one axis, mapping security concepts/mechanisms to devops on another.
Dynamic and short lived secrets for authorisation, see for example AWS IAM Roles are implemented or Hashicorp Vault.
Open Source: Simplifying Serverless Secrets
https://open.nytimes.com/open-source-simplifying-serverless-secrets-in-google-cloud-a95451e545b1
Vault and kubernetes
https://github.com/kelseyhightower/vault-on-google-kubernetes-engine
CI/CD enables automated program hardening:
Operating system protection through program evolution, Fred Cohen, 1993
Check your repos... Crypto-coin-stealing code sneaks into fairly popular NPM lib (2m downloads per week)
https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/
7 Tips for Container and Kubernetes Security
http://lxer.com/module/newswire/ext_link.php?rid=264809
Microservices Hierarchy of Needs
KUBERNETES: AN OVERVIEW (This is a nice introduction to Kubernetes architecture and advantages)
On The Relation Between Outdated Docker Containers, Severity Vulnerabilities and Bugs.
http://arxiv.org/abs/1811.12874
Reproducible builds
https://reproducible-builds.org/
added wikipedia references in the top post of this thread.
Security standards: NIST800 53, ISO27000
Super Secret Dynamic Secrets with Vault
https://tech.gogoair.com/super-secret-dynamic-secrets-with-vault-cf6f29fefc8f
Vault
http://vaultproject.io
InSpec
https://www.inspec.io
On the Relation between Outdated Docker Containers, Severity Vulnerabilities, and Bugs.
https://arxiv.org/pdf/1811.12874
On the Impact of Outdated and Vulnerable Javascript Packages in Docker Images.
https://ieeexplore.ieee.org/abstract/document/8667984/
Kubernetes security: 5 mistakes to avoid
https://enterprisersproject.com/article/2019/5/kubernetes-security-5-mistakes
security for containers
https://github.com/coreos/clair
Two interesting papers on container security / vulnerabilities analysis:
The Three Rs of Enterprise Security: Rotate, Repave, and Repair
https://builttoadapt.io/the-three-r-s-of-enterprise-security-rotate-repave-and-repair-f64f6d6ba29d
A framework to secure the integrity of software supply chains
https://in-toto.io/
https://github.com/in-toto/in-toto/
Attack graph generation for microservice architecture
https://www.researchgate.net/profile/Amjad_Ibrahim/publication/332814067_Attack_graph_generation_for_microservice_architecture/links/5ccd8a30299bf14d9576f2f5/Attack-graph-generation-for-microservice-architecture.pdf
Everything You Ever Wanted To Know About Test-Case Reduction, But Didn’t Know to Ask
https://blog.trailofbits.com/2019/11/11/test-case-reduction/
Netflix's repulsive grizzly for Application Layer DoS Testing
https://github.com/netflix-skunkworks/repulsive-grizzly
OWASP https://www.owasp.org/
JFrog Xray is an application security SCA tool that integrates security directly into your DevOps workflows, https://jfrog.com/xray/
What DevOps Means for Risk Management
https://cloudacademy.com/blog/what-devops-means-for-risk-management/
Open Source Security: https://www.whitesourcesoftware.com/open-source-security/
The Next Generation of DevOps Adds Security into the Blend: https://resources.whitesourcesoftware.com/blog-whitesource/next-generation-devops
Hacking into Google's Network for $133,337 (keywords: Remote Code Execution / Google Cloud Deployment Manager )
https://www.ezequiel.tech/2020/05/rce-in-cloud-dm.html
Nist DevSecOps Documents https://csrc.nist.gov/Projects/devsecops/publications
- Zero Trust Architecture
- Building Secure Microservices-based Applications Using Service-Mesh Architecture
- Hardware-Enabled Security for Server Platforms: Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases
- Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF)
- Developing Cyber Resilient Systems: A Systems Security Engineering Approach
- Security Strategies for Microservices-based Application Systems
- Security Recommendations for Server-based Hypervisor Platforms
- Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems
- Application Container Security Guide
- Secure Virtual Network Configuration for Virtual Machine (VM) Protection
- Guide to Enterprise Patch Management Technologies
- Guide to Security for Full Virtualization Technologies
The Linux Foundation created Sigstore to provide free certificates and tools to automate and verify signatures of software components, to defend software supply chain attacks.
http://sigstore.dev
The Dance Dance Authentication Scheme https://m.youtube.com/watch?v=VgC4b9K-gYU
Software of unknown pedigree
https://en.wikipedia.org/wiki/Software_of_unknown_pedigree
Mozilla Sops: Simple and flexible tool for managing secrets, encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP.
https://github.com/mozilla/sops
Monitoring the Software Supply Chain with Azure Sentinel
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463
Lacework is a startup company doing:
Securing your software supply chain, by Github
https://docs.github.com/en/code-security/supply-chain-security
Open Source Security Foundation
https://openssf.org/
OWASP ZAP zed attack proxy
https://www.zaproxy.org/
FYI, added https://en.wikipedia.org/wiki/Dynamic_application_security_testing to the reference list of wikipedia pages at the top.
signing, verifying and protecting software
https://www.sigstore.dev/
It’s Time to Get Hip to the SBOM
https://jfrog.com/blog/its-time-to-get-hip-to-the-sbom/
The steady project addresses the OWASP Top 10 security risk A9, Using Components with Known Vulnerabilities
https://projects.eclipse.org/projects/technology.
SpiceDB is a open source Zanzibar-inspired database that stores, computes, and validates fine grained permissions.
https://authzed.com/spicedb/
cas detects or acts on the following (but not limited to):
- Immutable tagging of source code, builds, and container images with version number, owner, timestamp, organization, trust level, and much more
- Simple and tamper-proof extraction of notarized tags like version number, owner, timestamp, organization, and trust level from any source code, build and container (based on the related image)
- Quickly discover and identify untrusted, revoked or obsolete libraries, builds, and containers in your application
- Detect the launch of an authorized or unknown container immediately
- Prevent untrusted or revoked containers from starting in production
- Verify the integrity and the publisher of all the data received over any channel
and more
- Enable application version checks and actions
- Buggy or rogue libraries can be traced by simple revoke or unsupport
- Revoke or unsupport your build or build version post-deployment (no complex certificate revocation that includes delivery of newly signed builds)
- Stop unwanted containers from being launched
- Make revocation part of the remediation process
- Use revocation without impairing customer environments
- Trace source code to build to deployment by integration into CI/CD or manual workflow
- Tag your applications for specific use cases (alpha, beta - non-commercial aso).
Google Cloud Key Management
https://cloud.google.com/security-key-management
OWASP Top 10 CI/CD Security Risks
https://owasp.org/www-project-top-10-ci-cd-security-risks/
Robbery on DevOps: Understanding and Mitigating Illicit Cryptomining on Continuous Integration Service Platforms
43rd Ieee Symposium On Security And Privacy (Sp 2022)
https://www.xiaojingliao.com/uploads/9/7/0/2/97024238/sp22-devops.pdf
- SPIFFE – Secure Production Identity Framework for Everyone
- SPIRE is the Runtime Environment
https://spiffe.io
A Static Analysis Platform for Investigating Security Trends in Repositories.
http://arxiv.org/abs/2304.01725
securing the software supply chain with optimized containers specific to your application needs, while automatically reducing vulnerabilities in the process.
Reverse Engineering the Tesla Firmware Update Process
https://www.pentestpartners.com/security-blog/reverse-engineering-the-tesla-firmware-update-process/
Scan (skæn) is an open-source security audit tool for modern DevOps teams
https://appthreat.com/en/latest/
Bitwarden Secrets Manager enables developers, DevOps, and cybersecurity teams to centrally store, manage, and deploy secrets at scale.
GitGuardian is a developer-first solution scanning GitHub activity in real-time for API secret tokens, database credentials
https://github.com/GitGuardian
Detecting intrusion with canary tokens
A canary token is a resource that is monitored for access or tampering. Usually, canary tokens come in the form of a URL, file, API key, or email, etc., and trigger alerts whenever someone (presumably an attacker) trips over them.
Securing the Supply Chain for Your Java Applications By Thomas Vitale. Devoxx 2023
https://www.youtube.com/watch?v=ftPFxK8JPNM
Where does your software (really) come from?
https://github.blog/2024-04-30-where-does-your-software-really-come-from/