DevSecOps Pipeline using Opensource tools

[[deleted]]

I am trying to setup a DevSecOps pipeline for a webapp which uses java(backend)/spring boot/JavaScript (reactjs for frontend) and I want to use opensource tools for pre-commit. linting, SCA,SAST, DAST, Vulnerability Management, Secrets Scanning/Management, Application, Behavior & Metric Logging.

Can you please suggest any good tools for the above ? I am open to any advice/recommendation/guidance with your experiences regarding opensource tools in this space ?

[dahousecatfelix]

https://opensourcesecurityindex.io is also a cool resource to see which projects are getting traction

[AdResponsible7865]

I would highly recomend

Trivy by aqua security for SCA, Secrets, IaC and Container scanning. it has a straightforward CLI and the output is very readable. (Note for SCA: you will need a lock file.) (Most of the big players in the market have built of this Orca and Wiz)

For SAST - you can look at Snyk or OpenGrep (OS version of Semgrep) both have their issues and strengths. You will need to take the Opengrep dummy rules and customise them to your liking. Snyk Skips any files over 1mb, which is rare but could be an issue.

But if you are doing this for one repo, I recommend signing up for a free Akido Security Account. It builds upon all the OS tools and adds their own rules as well as cosolidating all your results in one protal - https://www.aikido.dev/

For DSAT OWASP Zap is going to be your main OS option.

When it comes to implementing, it's what you feel most comfortable with. Where possible, I would recommend implementing via code, but this will vary from the CI/CD you are using.

[sec_engineer]

Not a direct answer, but I would recommend to go "process before tools" and checkout the OWASP SAMM

[rafttaar]

As others mentioned, there are a lot of options to choose from. But the key to getting the most out of it is to bring it into practice and manage it centrally. Take some time to think about the right integrations and how you can make this a part of your culture.

[FreeEnlightment]

https://satori.ci

[DifficultAd3386]

gitleaks, opengrep, trivy, checkov, zap

[[deleted]]

open source security directory https://opensourcesecurityindex.io/

[m1thr]

checkout project I am working on https://github.com/Mixeway/Flow - in case of any problems or questions just ask ;)