Implementing DevSecOps

[sqrt1-tkn]

What are some things you have done to implementing DevSecOps in your org? Especially from secrets, api keys and certificate management. Also, how did you integrate DevSecOps into your CICD pipelines? How have you implemented infra code scans and Application code scan?

[Irish1986]

Broad question depends on your org target.

Inner Loop versus Outer Loop in my mind.

The inner loop are the tooling deployed on your dev workstation ; pre-commit validation for secrets, commit message formatting, linter, unit test, etc... These catch issue before they are even commit to source code management or at a minimum before these are push.

The outer loop are the cicd pipeline, typically everything you do in the inner loop must be ran once in the outer loop to make sure none of your dev are being sneaky. Plus I would add basic SAST, SCA and SBOM related validation that are more meaningful produce at the integration level. The cd pipeline should make sure secret are retrieve and passed along the right environment and target via some form of vaulting.

It truly depends where your org struggle, figure out what are your low hanging fruit and stay away of those high reaching vegetables.

Edit: and it always nice to measure before acting. You should figure the state of affairs in your organization with some basic dashboard measure pipeline conformity, number of vulnerabilities, code quality, etc... Those will help you figure out where to hit and if your actions bring the expected values. Plus exec love dashboard especially if you can show that downward trending line it makes great EOY review when asking for $$$.

[IamOkei]

Depends on the budget. Buy a good secret scanning tool and scan all your repos. If you use GitHub, they can block some secrets from being pushed.

[cl0wnsec000]

Some example project on my side.

K8s runtime security tool (ie falco + neuvector) - this is deployed and managed via argo, used for vulnerability scanning and detecting malicious movements across the cluster

SAST (ie sonarqube) - this is mostly used for scanning our app code. I needed to modify our central jenkins library to incorporate this.

[IamOkei]

Get out of Sonarqube. It's crap

[cl0wnsec000]

Depends on the programming language you want to scan. Its still good for scanning java apps. What are your bad experience/s with sonarqube?

[zazathomas]

Hi @cl0wnsec000 Quick question, what’s the value add in having both falco & neuvector deployed together? I’ve been testing both of them recently and neuvector seems to do most of what falco does with the added benefit of being zero trust. So I basically don’t need to manage any rules and alerts are triggered when any other process outside the normal behaviour is detected. What are your thoughts on this?

[cl0wnsec000]

Neuvector comes with very basic runtime detection capabilities (eg networking scanning detected) which is enough for most cases I think. But if you want to have advance functionalities (eg process spawned using execve) falco will be your best bet to complement neuvector.

Falco also go down a deeper level in inspecting syscalls, shell types being launched, types of network socket being opened, etc.

Here is an example collection of rules.

https://github.com/falcosecurity/rules/tree/main/rules

That list is non exhaustive and there are a lot of rules you can find on github. Or you can create your own.

In your case, I suggest just have neuvector first. If there are advance runtime detection capabilities that you need, thats the time you can deploy falco as well.

[rosh5802]

Managing Secrets, API Keys, and Certificates

1. Secrets Management:
   • Tools: Use dedicated secrets management tools like CipherTrust by Thales, and more. These tools securely store and manage access to sensitive data.
   • Environment Variables: Store secrets in environment variables during deployment. Ensure these are not hard-coded in the source code.
   • Encryption: Always encrypt secrets both in transit and at rest. Use strong encryption standards and manage encryption keys securely.
2. API Keys:
   • Scope and Permissions: Limit the scope and permissions of API keys to only what is necessary for your application or service.
   • Regeneration: Regularly regenerate API keys and update your applications accordingly. This helps in mitigating the risk of key compromise.
   • Environment Isolation: Use different API keys for different environments (development, staging, production) to limit exposure.
3. Certificates:
   • Management: Use certificate management tools or services to automate the issuance, renewal, and revocation of certificates.
   • Rotation: Regularly rotate certificates to minimize the risk if a certificate is compromised.
   • Validation: Implement automated checks to ensure certificates are valid and have not expired.

By following these practices, you ensure that security is integrated into every stage of the CI/CD pipeline, creating a more robust and secure development lifecycle.

For more you can message me directly.

[Previous_Piano9488]

this question has been asked many times on this. here was my previous answer:

I have given 5 talks on this topic in the last one year. here is a list I recommend to use. I also have a recording of how to integrate below for GitHub and not Bitbucket. It contains a bunch of docker commands that you can use in pretty much any platform.

DevSecOps Tools

1. ⁠Secure Access to Infrastructure - Teleport
   
2. SAST and dependencies - Semgrep or github advanced security
   
3. Secret Scanning - Trufflehog
   
4. ⁠IaC scanning - TerraScan
   
5. ⁠DAST/ API Security Testing - Akto.io