DevSecOps

Security in CI/CD, shift-left security, infrastructure as code security, and DevSecOps tools.

Overview

DevSecOps integrates security throughout the development lifecycle.

DevSecOps Pipeline

Code -> Build -> Test -> Deploy -> Monitor
  |      |      |      |        |
  SAST  SCA   DAST   IaC     Runtime
  Lint  Scan  Scan   Scan    Protection

Shift-Left Security

# GitHub Actions security pipeline
name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: SAST - CodeQL
        uses: github/codeql-action/analyze@v2
        
      - name: SCA - Snyk
        uses: snyk/actions@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          
      - name: Secret Scan - TruffleHog
        uses: trufflesecurity/trufflehog@main
        
      - name: IaC Scan - Checkov
        uses: bridgecrewio/checkov-action@master

IaC Security

# Terraform security scanning
# terraform scan

# tfsec example
# tfsec . --format json --out results.json

# Checkov example
# checkov -d . --framework terraform

Container Security

# Secure Dockerfile
FROM alpine:3.18

# Don't run as root
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

# Scan for vulnerabilities
# trivy image myapp:latest

Secret Management

# Kubernetes secrets
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

Security Gates

Practice

Implement a complete DevSecOps pipeline with security gates.