You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: LICENSE.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,12 +2,12 @@
2
2
3
3
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
4
4
5
-
## You are free to:
5
+
## You are free to
6
6
7
7
-**Share** — copy and redistribute the material in any medium or format
8
8
-**Adapt** — remix, transform, and build upon the material for any purpose, even commercially.
9
9
10
-
## Under the following terms:
10
+
## Under the following terms
11
11
12
12
-**Attribution** — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
13
13
@@ -17,10 +17,10 @@ This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 Intern
17
17
18
18
- You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
19
19
20
-
## Notices:
20
+
## Notices
21
21
22
22
You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation.
23
23
24
24
No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may need to be obtained before you use the material.
25
25
26
-
For more details, see the [full text](https://creativecommons.org/licenses/by-sa/4.0/legalcode) of the license.
26
+
For more details, see the [full text](https://creativecommons.org/licenses/by-sa/4.0/legalcode) of the license.
The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process.
2
+
3
+
The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process.
3
4
This project helps any companies of each size that have a development pipeline or, in other words, have a DevOps pipeline.
4
-
We try to draw a perspective of a secure DevOps pipeline during this project and then improve it based on our customized requirements.
5
+
We try to draw a perspective of a secure DevOps pipeline during this project and then improve it based on our customized requirements.
5
6
6
7
The Ideal goal is **"detect security issues (by design or application vulnerability) as early as possible."**
7
8
8
9
## Initial steps
10
+
9
11
DevSecOps is all about putting security into DevOps. But to keep up with the pace of CI/CD, security has to be injected early into software writing and testing.
[OWASP Proactive Controls](https://owasp.org/www-project-proactive-controls/) lists the top 10 security controls every developer has to implement while coding any application. Consider this set as the starting point when you have to design, write or test code in the DevSecOps cycle.
15
+
[OWASP Proactive Controls](https://owasp.org/www-project-proactive-controls/) lists the top 10 security controls every developer has to implement while coding any application. Consider this set as the starting point when you have to design, write or test code in the DevSecOps cycle.
14
16
15
17
You can also follow the [OWASP Software Assurance Maturity Model (SAMM)](https://owaspsamm.org/model/) to establish what to consider for security requirements (and more) according to your maturity level.
At first, we consider implementing the following steps in a basic pipeline:
20
-
* Scan git repositories for finding potential credentials leakage.
21
-
* SCA (Software Composition Analysis)
22
-
* SAST (Static Application Security Test)
23
-
* IaC Scanning (Scanning Terraform, HelmChart code to find misconfiguration)
24
-
* IAST (Interactive Application Security Testing)
25
-
* API Security
26
-
* DAST (Dynamic Application Security Test)
27
-
* CNAPP (Cloud Native Application Protection)
28
-
* Infrastructure scanning
29
-
* Continuous Scanning from other tools
30
-
* Compliance check
23
+
24
+
- Scan git repositories for finding potential credentials leakage.
25
+
- SCA (Software Composition Analysis)
26
+
- SAST (Static Application Security Test)
27
+
- IaC Scanning (Scanning Terraform, HelmChart code to find misconfiguration)
28
+
- IAST (Interactive Application Security Testing)
29
+
- API Security
30
+
- DAST (Dynamic Application Security Test)
31
+
- CNAPP (Cloud Native Application Protection)
32
+
- Infrastructure scanning
33
+
- Continuous Scanning from other tools
34
+
- Compliance check
31
35
32
36
We can customize the steps of our pipeline according to our Software Development Life Cycle (SDLC) or software architecture and add automation progressively if we are starting.
33
37
For instance, we can switch from SAST/DAST to a regular test suite with built-in security controls or add an audit script checking for known vulnerable dependencies.
@@ -36,7 +40,9 @@ CI/CD is an advantage for SecOps, a privileged entry point for security measures
36
40
However, when using CI/CD tools to provide automation, keep in mind that the tools themselves often expand your attack surface, so put security controls on building, deployment, and automation software.
-[2-3-4-Infrastructure as Code Security](current-version/2-Process/2-3-Build/2-3-4-Infrastructure as Code Security)
74
+
-[2-3-1-3-Infastructure-as-Code-Scanning](current-version/2-Process/2-3-Build/2-3-4-Infrastructure as Code Security/2-3-1-3-Infastructure-as-Code-Scanning.md)
0 commit comments