Security and DevSecOps. Container Security¶
- Quality Gates
- 16 Gates
- Kubernetes Threat Modelling
- Kubernetes Config Security Threats
- Security Linting on Kubernetes
- IaC and Security
- Multi-Level Security (MLS) vs Multi-Category Security (MCS). Make Secure Pipelines with Podman and Containers
- Project Calico
- Security Patterns for Microservice Architectures
- Anchore Container Security Solutions for DevSecOps
- Twistlock and Threat Stack Container Security
- GitHub security
- Databases in DMZ and Intranet
- Removing Credentials From Git Repo
- SQL Injection
- Credential Managers
- GitOps Secret Management
- Serverless Security Best Practices
- Docker Images & Container Security
- Pod Security Policies
- Kubernetes Network Policies
- Static Analysis SAST
- Kubernetes Security Tools
- Helm Charts Security
- Password Recovery
- fiercesw.com: DevOps vs DevSecOps
- devopszone.info: DevSecOps Explained
- linkedin: Dear Google, my data has left your building!
- snyk.io: The State of Open Source Security 2020
- managedsentinel.com: Executive View — Current and Future Cybersecurity Architecture On One Page
- Exploring the (lack of) security in a typical Docker and Kubernetes installation
- kalilinuxtutorials.com: Deploying & Securing Kubernetes Clusters
- loves.cloud: Creating a fully automated DevSecOps CI/CD Pipeline
- redhat.com: Balancing Linux security with usability Your system should be secure, but open enough to serve its function. Here are some tips on how to strike that balance.
- thenewstack.io: Culture, Vulnerabilities and Budget: Why Devs and AppSec Disagree
- computing.co.uk: CloudBees gets busy with security, visibility and control as DevOps evolves CEO Sacha Labourey: ‘DevOps is a pretty good proxy for what needs to happen in any organisation’
- paloaltonetworks.com: Is Your Organization Protected Against IAM Misconfiguration Risks?
- devops.com: How to Successfully Integrate Security and DevOps
- helpnetsecurity.com: How to make DevSecOps stick with developers
- blog.christophetd.fr: Shifting Cloud Security Left — Scanning Infrastructure as Code for Security Issues
- devclass.com: Docker: It’s not dead yet, but there’s a tendency to walk away, security report finds
- roxsrossve.medium.com: El camino hacia DevSecOps
- securityboulevard.com: DevOps vs. DevSecOps – Here’s How They Fit Together
- opensource.com: How to adopt DevSecOps successfully Integrating security throughout the software development lifecycle is important, but it’s not always easy.
- devops.com: DevSecOps Trends to Know For 2021
- devops.com: From Agile to DevOps to DevSecOps: The Next Evolution
- permission.site How much stuff one can do from a web browser these days—scary stuff. Stay safe. Disable JS and most of stuff won’t work at all.
- ais.com: Leaping into DevSecOps from DevOps
- infoq.com: The Defense Department’s Journey with DevSecOps
- amazon.com: Building end-to-end AWS DevSecOps CI/CD pipeline with open source SCA, SAST and DAST tools
- infoq.com: 9 Trends That Are Influencing the Adoption of Devops and Devsecops in 2021
- addteq.com: The REAL Difference between DevOps and DevSecOps
- invensislearning.com: Difference between DevOps and DevSecOps
- techerati.com: DevSecOps: Eight tips for truly securing software
- devops.com: SecDevOps is the Solution to Cybersecurity 🌟
- techrepublic.com: DevOps is getting code released faster than ever. But security is lagging behind
- redeszone.net: No configurar bien la nube es culpable de la mayoría de vulnerabilidades
- cybersecuritydive.com: Relationships between DevOps, security warm slowly Some hurdles stem from miscommunication, or balancing quick product releases with undesired security gaps. “Security people need developers to be more like security people and developers need security people to be more like developers.” James Arlen, CISO at Aiven.
- bbvanexttechnologies.com: Filosofía DevSecOps en el desarrollo de aplicaciones sobre Azure
- dzone: DevOps Pipeline Quality Gates: A Double-Edged Sword In theory, quality gates seem like a no-brainer, but it does come with a catch.
- medium: Focusing on the DevOps Pipeline 🌟 Delivering High Quality Working Software Faster with Agile DevOps. At Capital One, we design pipelines using the concept of the “16 Gates”. These are our guiding design principles and they are:
- Source code version control
- Optimum branching strategy
- Static analysis
- More than 80% code coverage
- Vulnerability scan
- Open source scan
- Artifact version control
- Auto provisioning
- Immutable servers
- Integration testing
- Performance testing
- Build deploy testing automated for every commit
- Automated rollback
- Automated change order
- Zero downtime release
- Feature toggle
- github.com/hygieia/Hygieia 🌟 CapitalOne DevOps Dashboard
Kubernetes Threat Modelling¶
Kubernetes Config Security Threats¶
- cncf.io: Identifying Kubernetes Config Security Threats: Pods Running as Root
- mirantis.com: Introduction to Istio Ingress: The easy way to manage incoming Kubernetes app traffic Leaving your cluster exposed can be risky. That’s why you need Istio Ingress, which only exposes the part that handles incoming traffic & allows routing rules based on routes, headers, IP addresses and more.
- thenewstack.io: How Kubernetes vulnerabilities have shifted since the first attacks
Security Linting on Kubernetes¶
- kubeLinter 🌟 KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.
- thenewstack.io: StackRox KubeLinter Brings Security Linting to Kubernetes
IaC and Security¶
Multi-Level Security (MLS) vs Multi-Category Security (MCS). Make Secure Pipelines with Podman and Containers¶
- Why you should be using Multi-Category Security (MCS) for your Linux containers
- Using Podman and Containers to make a more secure pipeline
- Project Calico Secure networking for the cloud native era
- thenewstack.io: Project Calico: Kubernetes Security as SaaS
Security Patterns for Microservice Architectures¶
Anchore Container Security Solutions for DevSecOps¶
- Anchore Container image inspection and policy-based compliance
Twistlock and Threat Stack Container Security¶
- Threat Stack
- dzone: A Twistlock and Threat Stack Comparison Compare two of the most popular tools available for container security, and how their different approaches breed different solutions.
- vashishtsumit89.medium.com: Security/Pen Testing: A guide to run OWASP Zap headless in containers for CI/CD pipeline
- redeszone.net: OWASP ZAP, audita la seguridad de webs y evita vulnerabilidades
Secure Container Based CI/CD Workflows¶
Securing Kubernetes With Anchore¶
Databases in DMZ and Intranet¶
Removing Credentials From Git Repo¶
- forbes.com: DevOps Drives Pentesting Delivered As A Service
- emagined.com: How to conduct a penetration test
- securityboulevard.com: Kubernetes Pentest Methodology Part 3
- keycloak.org Open Source Identity and Access Management For Modern Applications and Services
- Securing Kubernetes Apps with Keycloak and Gatekeeper
- Authorizing multi-language microservices with Louketo Proxy
- developers.redhat.com: A deep dive into Keycloak
- blog.getambassador.io: Step-by-Step Centralized Authentication for Kubernetes with Keycloak and the Ambassador Edge Stack
- blog.sighup.io: How to run Keycloak in HA on Kubernetes How to setup Keycloak, the Open Source Identity and Access Management, in HA on Kubernetes.
- developers.redhat.com: Authentication and authorization using the Keycloak REST API
- faun.pub: Integrate Keycloak with HashiCorp Vault A How-To guide using Terraform
Git Credential Manager Core¶
- Git Credential Manager Core GCM Core is a free, open-source, cross-platform credential manager for Git.
- Git Credential Manager Core: Building a universal authentication experience
GitOps Secret Management¶
- vaultproject.io Manage Secrets and Protect Sensitive Data. Secure, store and tightly control access to tokens, passwords, certificates, encryption keys for protecting secrets and other sensitive data using a UI, CLI, or HTTP API.
- medium: Coding for Secrets Reliability with HashiCorp Vault
- hashicorp.com: Vault & Kubernetes: Better Together
- OpenShift Blogs:
- Vault Learning Resources: Vault 1.5 features and more
- medium: Securing K8s Ingress Traffic with HashiCorp Vault PKIaaS and JetStack Cert-Manager
- hashicorp.com: Automate Secret Injection into CI/CD Workflows with the GitHub Action for Vault
- hashicorp.com: Use AWS Lambda Extensions to Securely Retrieve Secrets From HashiCorp Vault Developers no longer have to make their Lambda functions Vault-aware.
- github.com/kelseyhightower: Serverless Vault with Cloud Run This tutorial walks you through deploying Hashicorp’s Vault on Cloud Run, Google Cloud’s container based Serverless compute platform.
- confluent.io: How to Manage Secrets for Confluent with Kubernetes and HashiCorp Vault
- digitalvarys.com: Simple Introduction to HashiCorp Vault
- hashicorp.com: HCP Vault is now generally available on AWS 🌟
- hashicorp.com: Serverless Secrets with HashiCorp Vault Learn how to securely store and retrieve credentials across providers for applications running within AWS Lambda, Azure Functions, and Google Cloud Functions.
- thenewstack.io: HashiCorp Releases HCP Vault to Combat ‘Secrets Management’ Fatigue
- datadoghq.com: Monitor HashiCorp Vault metrics and logs
- thenewstack.io: Reasons to Implement HashiCorp Vault and Other Zero Trust Tools
- hashicorp.com: Retrieve HashiCorp Vault Secrets with Kubernetes CSI Learn how to use CSI to expose secrets on a volume within a Kubernetes pod and retrieve them using our beta Vault Provider for the Kubernetes Secrets Store CSI Driver.
CyberArk and Ansible¶
- ansible.com: Simplifying secrets management with CyberArk and Red Hat Ansible Automation Platform
- ansible.com: Automating Security with CyberArk and Red Hat Ansible Automation Platform
SOPS for Kubernetes¶
Alternatives with Kubernetes External Secrets¶
- GitOps secret management with bitnami-labs Sealed Secret and GoDaddy Kubernetes External Secrets 🌟
- Kubernetes External Secrets 🌟 Integrate external secret management systems with Kubernetes. Kubernetes External Secrets allows you to use external secret management systems, like AWS Secrets Manager or HashiCorp Vault, to securely add secrets in Kubernetes.
- aws.amazon.com: Managing secrets deployment in Kubernetes using Sealed Secrets 🌟
- dzone: Managing Secrets Deployment in GitOps Workflow 🌟 The importance of keeping your secrets safe.
- blog.container-solutions.com: The Birth of the External Secrets Community
- itnext.io: Secrets injection at runtime from external Vault into Kubernetes — POC
- jx-secret-postrenderer 🌟 a helm postrenderer for working with helm and Kubernetes External Secrets. This post renderer lets you use helm charts which contain Secret resources and have those secrets managed by Kubernetes External Secrets without having to modify your charts. Want seamless support for kubernetes external secrets with existing helm charts? but you’re not using Jenkins X yet? then why not try this helm post renderer.
Serverless Security Best Practices¶
Docker Images & Container Security¶
- thehackernews.com: Docker Images Containing Cryptojacking Malware Distributed via Docker Hub
- sysdig.com: 12 Container image scanning best practices to adopt in production
- infracloud.io: The Ten Commandments of Container Security
- medium: KubeSecOps Pipeline(Container security) in a cloudnative ecosystem
- sysdig.com: Sysdig 2021 container security and usage report: Shifting left is not enough 🌟
- itnext.io: Hardening Docker and Kubernetes with seccomp 🌟
- redhat.com: Improving Linux container security with seccomp 🌟 Try this method of using an OCI runtime hook for tracing syscalls before you build a container.
- openshift.com: Signing and Verifying Container Images 🌟
- redhat.com: Introducing Red Hat Vulnerability Scanner Certification
- docs.microsoft.com: Introduction to Azure Defender for container registries Defender for Container Registries Continuous Image Scan for vulnerabilities is now available for General Availability (GA)
- techbeacon.com: 17 open-source container security tools 🌟
Pod Security Policies¶
- octetz.com: Setting Up Pod Security Policies By default, Kubernetes allows anything capable of creating a Pod to run a fairly privileged container that can compromise a system. Pod Security Policies protect clusters from privileged pods by ensuring the requester is authorised.
- infracloud.io: Kubernetes Pod Security Policies with Open Policy Agent In this blog post, you will learn about the Pod Security Policy admission controller. Then you will see how Open Policy Agent can implement Pod Security Policies.
Kubernetes Network Policies¶
- medium.com: K8s Network Policies Demystified and Simplified 🌟
- blog.nody.cc: Verify your Kubernetes Cluster Network Policies: From Faith to Proof
Static Analysis SAST¶
Kubernetes Security Tools¶
- europeclouds.com: Implementing Aqua Security to Secure Kubernetes
- Pomerium is an identity-aware proxy that enables secure access to internal applications. Pomerium brings consistent authz/authn, tooling, and auditing across cloud and on-premise deployments. No VPN or cloud provider account is required
Helm Charts Security¶
- medium: Who’s at the Helm? Or, how to deploy 25+ CVEs to prod in one command!