devops-course
devops-course copied to clipboard
KTH
DevOps and Security - DevSecOps
Wikipedia references:
- https://en.wikipedia.org/wiki/Information_security
- https://en.wikipedia.org/wiki/Information_security_audit
- https://en.wikipedia.org/wiki/Attribute-based_access_control
- https://en.wikipedia.org/wiki/Penetration_test
- https://en.wikipedia.org/wiki/Intrusion_detection_system
- https://en.wikipedia.org/wiki/Runtime_application_self-protection
- https://en.wikipedia.org/wiki/Dynamic_application_security_testing
- https://en.wikipedia.org/wiki/Supply_chain_attack
Principles:
- Complete Mediation Principle (useful for APIs)
- Least privileged
Intrusion detection: https://en.wikipedia.org/wiki/Intrusion_detection_system
(signature based, anomaly detection)
Very good set of pointers: https://www.sqreen.io/checklists/devops-security-checklist
Mapping security design principles to devops on one axis, mapping security concepts/mechanisms to devops on another.
Dynamic and short lived secrets for authorisation, see for example AWS IAM Roles are implemented or Hashicorp Vault.
Open Source: Simplifying Serverless Secrets https://open.nytimes.com/open-source-simplifying-serverless-secrets-in-google-cloud-a95451e545b1
Vault and kubernetes https://github.com/kelseyhightower/vault-on-google-kubernetes-engine
CI/CD enables automated program hardening:
Operating system protection through program evolution, Fred Cohen, 1993
Check your repos... Crypto-coin-stealing code sneaks into fairly popular NPM lib (2m downloads per week) https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/
7 Tips for Container and Kubernetes Security http://lxer.com/module/newswire/ext_link.php?rid=264809
Microservices Hierarchy of Needs KUBERNETES: AN OVERVIEW (This is a nice introduction to Kubernetes architecture and advantages)
On The Relation Between Outdated Docker Containers, Severity Vulnerabilities and Bugs. http://arxiv.org/abs/1811.12874
Super Secret Dynamic Secrets with Vault https://tech.gogoair.com/super-secret-dynamic-secrets-with-vault-cf6f29fefc8f
On the Relation between Outdated Docker Containers, Severity Vulnerabilities, and Bugs. https://arxiv.org/pdf/1811.12874
On the Impact of Outdated and Vulnerable Javascript Packages in Docker Images. https://ieeexplore.ieee.org/abstract/document/8667984/
Kubernetes security: 5 mistakes to avoid https://enterprisersproject.com/article/2019/5/kubernetes-security-5-mistakes
Two interesting papers on container security / vulnerabilities analysis:
- ConPan: a tool to analyze packages in software containers. MSR 2019: 592-596
- On the Relation between Outdated Docker Containers, Severity Vulnerabilities, and Bugs. SANER 2019: 491-501
The Three Rs of Enterprise Security: Rotate, Repave, and Repair https://builttoadapt.io/the-three-r-s-of-enterprise-security-rotate-repave-and-repair-f64f6d6ba29d
A framework to secure the integrity of software supply chains https://in-toto.io/ https://github.com/in-toto/in-toto/
Attack graph generation for microservice architecture https://www.researchgate.net/profile/Amjad_Ibrahim/publication/332814067_Attack_graph_generation_for_microservice_architecture/links/5ccd8a30299bf14d9576f2f5/Attack-graph-generation-for-microservice-architecture.pdf
Everything You Ever Wanted To Know About Test-Case Reduction, But Didn’t Know to Ask https://blog.trailofbits.com/2019/11/11/test-case-reduction/
Netflix's repulsive grizzly for Application Layer DoS Testing https://github.com/netflix-skunkworks/repulsive-grizzly
OWASP https://www.owasp.org/
JFrog Xray is an application security SCA tool that integrates security directly into your DevOps workflows, https://jfrog.com/xray/
