Skip to content

Latest commit

 

History

History
358 lines (280 loc) · 44.5 KB

README.md

File metadata and controls

358 lines (280 loc) · 44.5 KB

Ultimate DevSecOps library

Contribution rules

If you want to contribute to this library of knowledge please create proper PR (Pull Request) with description what you are adding following these set of rules:

  • Clear description of PR (which tool, why, number of stars, maturity and topic)
  • Keep it simple - Fill the description properly
  • Fact over feelings or personal opinions
  • Add source and follow the library style
  • Avoid duplicits - one tool, one topic
  • Try to make bigger updates then on tool link
  • Currently open-source only
  • Add only active projects
  • Add only security tools

Note: Currently this is an early version of the library. I recommend PR after first official release.

DevSecOps library info:

stars watchers watchers

This library contains list of tools and methodologies accompanied with resources. The main goal is to provide to the engineers a guide through opensource DevSecOps tooling. This repository covers only cyber security in the cloud and the DevSecOps scope.

Table of Contents

What is DevSecOps

DevSecOps focuses on security automation, testing and enforcement during DevOps - Release - SDLC cycles. The whole meaning behind this methodology is connecting together Development, Security and Operations. DevSecOps is methodology providing different methods, techniques and processes backed mainly with tooling focusing on developer / security experience.

DevSecOps takes care that security is part of every stage of DevOps loop - Plan, Code, Build, Test, Release, Deploy, Operate, Monitor.

Various definitions:

Tooling

Pre-commit time tools

In this section you can find lifecycle helpers, precommit hook tools and threat modeling tools. Threat modeling tools are specific category by themselves allowing you to simulate and discover potential gaps before you start to develop the software or during the process.

Modern DevSecOps tools allow using Threat modeling as code or generation of threat models based on the existing code annotations.

Name URL Description Meta
git-secrets https://github.com/awslabs/git-secrets AWS labs tool preventing you from committing secrets to a git repository Git Secrets
git-hound https://github.com/tillson/git-hound Searchers secrets in git git-hound
goSDL https://github.com/slackhq/goSDL Security Development Lifecycle checklist goSDL
ThreatPlaybook https://github.com/we45/ThreatPlaybook Threat modeling as code GitLeaks
Threat Dragon https://github.com/OWASP/threat-dragon OWASP Threat modeling tool ThreatDragon
threatspec https://github.com/threatspec/threatspec Threat modeling as code threatspec
pytm https://github.com/izar/pytm A Pythonic framework for threat modeling pytm
Threagile https://github.com/Threagile/threagile A Pythonic framework for threat modeling Threagile
MAL-lang https://mal-lang.org/#what A language to create cyber threat modeling systems for specific domains Mal
Microsoft Threat modeling tool https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool Microsoft threat modeling tool MS Threat modeling tool
Talisman https://github.com/thoughtworks/talisman A tool to detect and prevent secrets from getting checked in Talisman
SEDATED https://github.com/OWASP/SEDATED The SEDATED® Project (Sensitive Enterprise Data Analyzer To Eliminate Disclosure) focuses on preventing sensitive data such as user credentials and tokens from being pushed to Git. Talisman
Sonarlint https://github.com/SonarSource/sonarlint-core Sonar linting utility for IDE Sonarlint
DevSkim https://github.com/microsoft/DevSkim DevSkim is a framework of IDE extensions and language analyzers that provide inline security analysis DevSkim
detect-secrets https://github.com/Yelp/detect-secrets Detects secrets in your codebase DevSkim
tflint https://github.com/terraform-linters/tflint A Pluggable Terraform Linter tflint

Secrets management

Secrets management includes managing, versioning, encryption, discovery, rotating, provisioning of passwords, certificates, configuration values and other types of secrets.

Name URL Description Meta
GitLeaks https://github.com/zricethezav/gitleaks Gitleaks is a scanning tool for detecting hardcoded secrets GitLeaks
ggshield https://github.com/gitguardian/ggshield GitGuardian shield (ggshield) is a CLI application that runs in your local environment or in a CI environment and helps you detect more than 350+ types of secrets and sensitive files. ggshield
TruffleHog https://github.com/trufflesecurity/truffleHog TruffleHog is a scanning tool for detecting hardcoded secrets TruffleHog
Hashicorp Vault https://github.com/hashicorp/vault Hashicorp Vault secrets management Vault
Mozilla SOPS https://github.com/mozilla/sops Mozilla Secrets Operations SOPS
AWS secrets manager GH action https://github.com/marketplace/actions/aws-secrets-manager-actions AWS secrets manager docs AWS Secrets manager action
GitRob https://github.com/michenriksen/gitrob Gitrob is a tool to help find potentially sensitive files pushed to public repositories on Github GitRob
git-wild-hunt https://github.com/d1vious/git-wild-hunt A tool to hunt for credentials in the GitHub git-wild-hunt
aws-vault https://github.com/99designs/aws-vault AWS Vault is a tool to securely store and access AWS credentials in a development environment aws-vault
Knox https://github.com/pinterest/knox Knox is a service for storing and rotation of secrets, keys, and passwords used by other services Knox
Chef vault https://github.com/chef/chef-vault allows you to encrypt a Chef Data Bag Item Chef vault
Ansible vault Ansible vault docs Encryption/decryption utility for Ansible data files Ansible vault

OSS and Dependency management

Dependency security testing and analysis is very important part of discovering supply chain attacks. SBOM creation and following dependency scanning (Software composition analysis) is critical part of continuous integration (CI). Data series and data trends tracking should be part of CI tooling. You need to know what you produce and what you consume in context of libraries and packages.

Name URL Description Meta
CycloneDX https://github.com/orgs/CycloneDX/repositories CycloneDX format for SBOM CycloneDX
SPDX https://github.com/spdx/spdx-spec SPDX format for SBOM - Software Package Data Exchange SpDX
Snyk https://github.com/snyk/snyk Snyk scans and monitors your projects for security vulnerabilities Snyk
vulncost https://github.com/snyk/vulncost Security Scanner for VS Code Vulncost
Dependency Combobulator https://github.com/apiiro/combobulator Dependency-related attacks detection and prevention through heuristics and insight engine (support multiple dependency schemes) Combobulator
DependencyTrack https://github.com/DependencyTrack/dependency-track Dependency security tracking platform DependencyTrack
DependencyCheck https://github.com/jeremylong/DependencyCheck Simple dependency security scanner good for CI DependencyCheck
Retire.js https://github.com/retirejs/retire.js/ Helps developers to detect the use of JS-library versions with known vulnerabilities Retire.js
PHP security checker https://github.com/fabpot/local-php-security-checker Check vulnerabilities in PHP dependencies Retire.js
bundler-audit https://github.com/rubysec/bundler-audit Patch-level verification for bundler Bundler audit
gemnasium https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium Dependency Scanning Analyzer based on Gemnasium
Dependabot https://github.com/dependabot/dependabot-core Automated dependency updates built into GitHub providing security alerts Dependabot
Renovatebot https://github.com/renovatebot/renovate Automated dependency updates, patches multi-platform and multi-language Renovatebot
npm-check https://www.npmjs.com/package/npm-check Check for outdated, incorrect, and unused dependencies. npm-check

Supply chain specific tools

Supply chain is often the target of attacks. Which libraries you use can have a massive impact on security of the final product (artifacts). CI (continuous integration) must be monitored inside the tasks and jobs in pipeline steps. Integrity checks must be stored out of the system and in ideal case several validation runs with comparison of integrity hashes / or attestation must be performed.

Name URL Description Meta
Tekton chains https://github.com/tektoncd/chains Kubernetes Custom Resource Definition (CRD) controller that allows you to manage your supply chain security in Tekton. Chains
in-toto https://github.com/in-toto/attestation/tree/v0.1.0/spec An in-toto attestation is authenticated metadata about one or more software artifacts in-toto
SLSA Official GitHub link Supply-chain Levels for Software Artifacts SLSA
kritis https://github.com/grafeas/kritis Solution for securing your software supply chain for Kubernetes apps Kritis
ratify https://github.com/deislabs/ratify Artifact Ratification Framework ratify

SAST

Static code review tools working with source code and looking for known patterns and relationships of methods, variables, classes and libraries. SAST works with the raw code and usually not with build packages.

Name URL Description Meta
Brakeman https://github.com/presidentbeef/brakeman Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities Brakeman
Semgrep https://semgrep.dev/ Hi-Quality Open source, works on 17+ languages Semgrep
Bandit https://github.com/PyCQA/bandit Python specific SAST tool Bandit
libsast https://github.com/ajinabraham/libsast Generic SAST for Security Engineers. Powered by regex based pattern matcher and semantic aware semgrep libsast
ESLint https://eslint.org/ Find and fix problems in your JavaScript code
nodejsscan https://github.com/ajinabraham/nodejsscan NodeJs SAST scanner with GUI NodeJSscan
FindSecurityBugs https://find-sec-bugs.github.io/ The SpotBugs plugin for security audits of Java web applications FindSecuritybugs
SonarQube community https://github.com/SonarSource/sonarqube Detect security issues in code review with Static Application Security Testing (SAST) SonarQube
gosec https://github.com/securego/gosec Inspects source code for security problems by scanning the Go AST. SonarQube

Note: Semgrep is free CLI tool, however some rulesets (https://semgrep.dev/r) are having various licences, some can be free to use and can be commercial.

OWASP curated list of SAST tools : https://owasp.org/www-community/Source_Code_Analysis_Tools

DAST

Dynamic application security testing (DAST) is a type of application testing (in most cases web) that checks your application from the outside by active communication and analysis of the responses based on injected inputs. DAST tools rely on inputs and outputs to operate. A DAST tool uses these to check for security problems while the software is actually running and is actively deployed on the server (or serverless function).

Name URL Description Meta
Zap proxy https://owasp.org/www-project-zap/ Zap proxy providing various docker containers for CI/CD pipeline ZAP
Wapiti https://github.com/wapiti-scanner/wapiti Light pipeline ready scanning tool Wapiti
Nuclei https://github.com/projectdiscovery/nuclei Template based security scanning tool Nuclei
purpleteam https://github.com/purpleteam-labs/purpleteam CLI DAST tool incubator project purpleteam
oss-fuzz https://github.com/google/oss-fuzz OSS-Fuzz: Continuous Fuzzing for Open Source Software osss-fuzz
nikto https://github.com/sullo/nikto Nikto web server scanner nikto
skipfish https://code.google.com/archive/p/skipfish/ Skipfish is an active web application security reconnaissance tool skipfish

Continuous deployment security

Name URL Description Meta
SecureCodeBox https://github.com/secureCodeBox/secureCodeBox Toolchain for continuous scanning of applications and infrastructure SCB
OpenSCAP https://github.com/OpenSCAP/openscap Open Source Security Compliance Solution oscap

Kubernetes

Name URL Description Meta
KubiScan https://github.com/cyberark/KubiScan A tool for scanning Kubernetes cluster for risky permissions Kubiscan
Kubeaudit https://github.com/Shopify/kubeaudit Audit Kubernetes clusters for various different security concerns kube-audit
Kubescape https://github.com/armosec/kubescape The first open-source tool for testing if Kubernetes is deployed according to the NSA-CISA and the MITRE ATT&CK®. kubescape
kubesec https://github.com/controlplaneio/kubesec Security risk analysis for Kubernetes resources kubesec
kube-bench https://github.com/aquasecurity/kube-bench Kubernetes benchmarking tool Kubiscan
kube-score https://github.com/zegl/kube-score Static code analysis of your Kubernetes object definitions kube-score
kube-hunter https://github.com/aquasecurity/kube-hunter Active scanner for k8s (purple) kube-hunter
Calico https://github.com/projectcalico/calico Calico is an open source networking and network security solution for containers Calico
Kyverno https://github.com/kyverno/kyverno/ Kyverno is a policy engine designed for Kubernetes kyverno
Krane https://github.com/appvia/krane Simple Kubernetes RBAC static analysis tool krane
Starboard https://github.com/aquasecurity/starboard Starboard inegrates security tools by outputs into Kubernetes CRDs starboard
Gatekeeper https://github.com/open-policy-agent/gatekeeper Open policy agent gatekeeper for k8s gatekeeper
Inspektor-gadget https://github.com/kinvolk/inspektor-gadget Collection of tools (or gadgets) to debug and inspect k8s inspector
kube-linter https://github.com/stackrox/kube-linter Static analysis for Kubernetes kube-linter

Containers

Name URL Description Meta
Harbor https://github.com/goharbor/harbor Trusted cloud native registry project Harbor
Anchore https://github.com/anchore/anchore-engine Centralized service for inspection, analysis, and certification of container images Anchore
Clair https://github.com/quay/clair Docker vulnerability scanner Clair
Deepfence ThreatMapper https://github.com/deepfence/ThreatMapper Apache v2, powerful runtime vulnerability scanner for kubernetes, virtual machines and serverless. ThreatMapper
Docker bench https://github.com/docker/docker-bench-security Docker benchmarking against CIS docker bench
Falco https://github.com/falcosecurity/falco Container runtime protection Falco
Trivy https://github.com/aquasecurity/trivy Comprehensive scanner for vulnerabilities in container images Trivy
Notary https://github.com/notaryproject/notary Docker signing Notary
Cosign https://github.com/sigstore/cosign Container signing Cosign
watchtower https://github.com/containrrr/watchtower Updates the running version of your containerized app watchtower

Multi-Cloud

Name URL Description Meta
Cloudsploit https://github.com/aquasecurity/cloudsploit Detection of security risks in cloud infrastructure Cloudsploit
ScoutSuite https://github.com/nccgroup/ScoutSuite NCCgroup mutlicloud scanning tool ScoutSuite
CloudCustodian https://github.com/cloud-custodian/cloud-custodian/ Multicloud security analysis framework CloudCustodian
CloudGraph https://github.com/cloudgraphdev/cli GraphQL API + Security for AWS, Azure, GCP, and K8s CloudGraph

AWS

AWS specific DevSecOps tooling. Tools here cover different areas like inventory management, misconfiguration scanning or IAM roles and policies review.

Name URL Description Meta
Dragoneye https://github.com/indeni/dragoneye Dragoneye Indeni AWS scanner Dragoneye
Prowler https://github.com/toniblyx/prowler Prowler is a command line tool that helps with AWS security assessment, auditing, hardening and incident response. Prowler
aws-inventory https://github.com/nccgroup/aws-inventory Helps to discover all AWS resources created in an account aws-inventory
PacBot https://github.com/tmobile/pacbot Policy as Code Bot (PacBot) pacbot
Komiser https://github.com/mlabouardy/komiser Monitoring dashboard for costs and security komiser
Cloudsplaining https://github.com/salesforce/cloudsplaining IAM analysis framework cloudsplaining
ElectricEye https://github.com/jonrau1/ElectricEye Continuously monitor your AWS services for configurations ElectricEye
Cloudmapper https://github.com/duo-labs/cloudmapper CloudMapper helps you analyze your Amazon Web Services (AWS) environments cloudmapper
cartography https://github.com/lyft/cartography Consolidates AWS infrastructure assets and the relationships between them in an intuitive graph cartography
policy_sentry https://github.com/salesforce/policy_sentry IAM Least Privilege Policy Generator policycentry
AirIAM https://github.com/bridgecrewio/AirIAM IAM Least Privilege anmalyzer and Terraformer AirIam
StreamAlert https://github.com/airbnb/streamalert AirBnB serverless, real-time data analysis framework which empowers you to ingest, analyze, and alert StreamAlert
CloudQuery https://github.com/cloudquery/cloudquery/ AirBnB serverless, real-time data analysis framework which empowers you to ingest, analyze, and alert CloudQuery
S3Scanner https://github.com/sa7mon/S3Scanner/ A tool to find open S3 buckets and dump their contents S3Scanner
aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/ A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster authenticator
kube2iam https://github.com/jtblin/kube2iam/ A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster kube2iam
AWS open source security samples Official AWS opensource repo Collection of official AWS open-source resources Amazon AWS

Google cloud platform

GCP specific DevSecOps tooling. Tools here cover different areas like inventory management, misconfiguration scanning or IAM roles and policies review.

Name URL Description Meta
Forseti https://github.com/forseti-security/forseti-security Complex security orchestration and scanning platform Forseti

Policy as code

Policy as code is the idea of writing code in a high-level language to manage and automate policies. By representing policies as code in text files, proven software development best practices can be adopted such as version control, automated testing, and automated deployment. (Source: https://docs.hashicorp.com/sentinel/concepts/policy-as-code)

Name URL Description Meta
Open Policy agent https://github.com/open-policy-agent/opa General-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack OPA
Inspec https://github.com/inspec/inspec Chef InSpec is an open-source testing framework for infrastructure with a human- and machine-readable language for specifying compliance, security and policy requirements. Inspec
Cloud Formation guard https://github.com/aws-cloudformation/cloudformation-guard Cloud Formation policy as code cf-guard

Chaos engineering

Chaos Engineering is the discipline of experimenting on a system in order to build confidence in the system’s capability to withstand turbulent conditions in production.

Reading and manifestos: https://principlesofchaos.org/

Name URL Description Meta
chaos-mesh https://github.com/chaos-mesh/chaos-mesh It is a cloud-native Chaos Engineering platform that orchestrates chaos on Kubernetes environments Chaos mesh
Chaos monkey https://netflix.github.io/chaosmonkey/ Chaos Monkey is responsible for randomly terminating instances in production to ensure that engineers implement their services to be resilient to instance failures. Chaos monkey
chaoskube https://github.com/linki/chaoskube Test how your system behaves under arbitrary pod failures. chaoskube
Kube-Invaders https://github.com/lucky-sideburn/KubeInvaders Gamified chaos engineering tool for Kubernetes chaoskube
kube-monkey https://github.com/asobti/kube-monkey Gamified chaos engineering tool for Kubernetes kube-monkey
Gremlin https://github.com/gremlin/gremlin-python Chaos enginnering SaaS platform with free plan and some open source libraries Gremlin
AWS FIS samples https://github.com/aws-samples/aws-fault-injection-simulator-samples AWS Fault injection simulator samples AWS
CloudNuke https://github.com/gruntwork-io/cloud-nuke CLI tool to delete all resources in an AWS account CloudNuke

Infrastructure as code security

Scanning your infrastructure when it is only code helps shift-left the security. Many tools offer in IDE scanning and providing real-time advisory do Cloud engineers.

Name URL Description Meta
KICS https://github.com/Checkmarx/kics Checkmarx security testing opensource for IaC Checkmarx
Checkov https://github.com/bridgecrewio/checkov Checkov is a static code analysis tool for infrastructure-as-code Checkov
tfsec https://github.com/aquasecurity/tfsec tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform CDK support tfsec
terrascan https://github.com/accurics/terrascan Terrascan is a static code analyzer for Infrastructure as Code terrascan
cfsec https://github.com/aquasecurity/cfsec cfsec scans CloudFormation configuration files for security issues cfsec
cfn_nag https://github.com/stelligent/cfn_nag Looks for insecure patterns in CloudFormation cfnag
Sysdig IaC scanner action https://github.com/sysdiglabs/cloud-iac-scanner-action Scans your repository with Sysdig IAC Scanner and report the vulnerabilities. sysdig iac scanner

Orchestration

Event driven security help to drive, automate and execute tasks for security processes. The tools here and not dedicated security tools but are helping to automate and orchestrate security tasks or are part of most modern security automation frameworks or tools.

Name URL Description Meta
StackStorm https://github.com/StackStorm/st2 Platform for integration and automation across services and tools supporting event driven security StackStorm
Camunda https://github.com/camunda/camunda-bpm-platform Workflow and process automation Camunda
DefectDojo https://github.com/DefectDojo/django-DefectDojo Security orchestration and vulnerability management platform DefectDojo

Methodologies, whitepapers and architecture

List of resources worth investigating:

AWS DevOps whitepapers:

AWS blog:

Microsoft whitepapers:

GCP whitepapers:

Other

Here are the other links and resources that do not fit in any previous category. They can meet multiple categories in time or help you in your learning.

Name URL Description Meta
Mobile security framework https://github.com/MobSF/Mobile-Security-Framework-MobSF SAST, DAST and pentesting tool for mobile apps MobSF

Training - https://www.practical-devsecops.com/devsecops-university/

DevSecOps videos - Hackitect playground

License

MIT license

Marek Šottl (c) 2022