tomevault-io DevSecOps
A comprehensive DevSecOps skill that helps integrate security practices throughout the software development lifecycle, from code to production.
Quick Start
Basic DevSecOps workflow:
# Shift security left
# Automate security checks in CI/CD
# Scan code, dependencies, containers, infrastructure
# Monitor and respond to security incidents
# Maintain compliance and audit trails
Core Capabilities
1. Security Scanning
Static Application Security Testing (SAST)
- Code analysis for security vulnerabilities
- Pattern detection for common flaws (SQL injection, XSS, etc.)
- Security code review automation
- Tools: SonarQube, Checkmarx, Semgrep, CodeQL
Dynamic Application Security Testing (DAST)
- Runtime security testing
- API security testing
- Penetration testing automation
- Tools: OWASP ZAP, Burp Suite, Acunetix
Software Composition Analysis (SCA)
- Dependency vulnerability scanning
- License compliance checking
- Open source security
- Tools: Snyk, Dependabot, WhiteSource, Black Duck
2. Container Security
Image Scanning
- Vulnerability scanning for base images
- Malware detection
- Configuration analysis
- Tools: Trivy, Clair, Anchore, Aqua Security
Runtime Security
- Container behavior monitoring
- Anomaly detection
- Runtime policy enforcement
- Tools: Falco, Sysdig, Aqua, Twistlock
Kubernetes Security
- Pod security policies
- Network policies
- RBAC configuration
- Admission controllers
- Tools: OPA, Kyverno, Falco, KubeSec
3. Infrastructure Security
Infrastructure as Code (IaC) Scanning
- Terraform security analysis
- CloudFormation scanning
- Kubernetes manifests validation
- Tools: Checkov, tfsec, Terrascan, kube-score
Cloud Security Posture Management (CSPM)
- AWS/Azure/GCP security configuration
- Compliance monitoring
- Misconfiguration detection
- Tools: AWS Security Hub, Azure Security Center, Prowler
Network Security
- Firewall rules analysis
- Network segmentation
- Traffic monitoring
- Security groups validation
4. Secrets Management
Secret Scanning
- Detect hardcoded credentials in code
- Git history scanning
- Configuration file analysis
- Tools: GitGuardian, TruffleHog, git-secrets, Gitleaks
Secret Storage & Rotation
- Centralized secret management
- Automated rotation
- Access control and auditing
- Tools: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault
5. CI/CD Pipeline Security
Pipeline Hardening
- Secure pipeline configuration
- Build environment isolation
- Artifact signing and verification
- Supply chain security
Security Gates
- Automated security checks in pipeline
- Quality gates based on severity
- Break the build on critical issues
- Exception management
Compliance Automation
- SOC 2, HIPAA, PCI-DSS checks
- Policy as code
- Automated evidence collection
- Audit trail generation
6. Application Security
API Security
- API authentication and authorization
- Rate limiting and throttling
- Input validation
- API gateway security
Authentication & Authorization
- OAuth2/OIDC implementation
- JWT validation
- RBAC and ABAC
- Multi-factor authentication
Data Security
- Encryption at rest and in transit
- Data masking and anonymization
- Key management
- PII/PHI protection
7. Monitoring & Incident Response
Security Monitoring
- SIEM integration
- Log aggregation and analysis
- Threat detection
- Tools: ELK Stack, Splunk, Datadog Security
Vulnerability Management
- CVE tracking and prioritization
- Patch management
- Vulnerability disclosure
- SLA management
Incident Response
- Security incident playbooks
- Automated remediation
- Post-incident analysis
- Lessons learned documentation
8. Compliance & Governance
Compliance Frameworks
- SOC 2 Type II
- ISO 27001
- HIPAA
- PCI-DSS
- GDPR
Policy Management
- Security policies as code
- Policy enforcement
- Exception tracking
- Regular audits
Risk Assessment
- Threat modeling
- Risk scoring
- Attack surface analysis
- Security metrics and KPIs
Workflows
Secure SDLC Workflow
┌─────────────────────────────────────────────────────────┐
│ SECURE SDLC │
└─────────────────────────────────────────────────────────┘
1. PLAN & DESIGN
├── Threat modeling
├── Security requirements
└── Architecture security review
2. DEVELOP
├── Secure coding guidelines
├── IDE security plugins
├── Pre-commit hooks (secret scanning)
└── Security-focused code reviews
3. BUILD
├── SAST (static code analysis)
├── SCA (dependency scanning)
├── Container image scanning
└── IaC security scanning
4. TEST
├── DAST (dynamic testing)
├── API security testing
├── Penetration testing
└── Security regression testing
5. DEPLOY
├── Container runtime security
├── Infrastructure security validation
├── Secrets injection
└── Security configuration checks
6. OPERATE
├── Runtime monitoring
├── Vulnerability management
├── Incident response
└── Compliance monitoring
7. MONITOR
├── Security logging
├── Threat detection
├── Anomaly detection
└── Security metrics
CI/CD Security Pipeline
# Example: Security-Integrated Pipeline
stages:
- security-scan
- build
- test
- security-test
- deploy
# Stage 1: Pre-build Security
security-scan:
stage: security-scan
script:
# Secret scanning
- trufflehog --regex --entropy=False .
# SAST scanning
- semgrep --config=auto --sarif > sast-results.sarif
# Dependency scanning
- snyk test --severity-threshold=high
# IaC scanning
- checkov -d . --framework terraform
artifacts:
reports:
sast: sast-results.sarif
# Stage 2: Build with security
build:
stage: build
script:
- docker build -t myapp:$CI_COMMIT_SHA .
# Sign container image
- cosign sign myapp:$CI_COMMIT_SHA
# Stage 3: Container scanning
container-scan:
stage: test
script:
- trivy image --severity HIGH,CRITICAL myapp:$CI_COMMIT_SHA
- docker scan myapp:$CI_COMMIT_SHA
allow_failure: false # Break build on critical issues
# Stage 4: Dynamic security testing
dast:
stage: security-test
script:
# Deploy to staging
- kubectl apply -f k8s/staging/
# Run DAST
- zap-baseline.py -t https://staging.example.com
# API security test
- postman collection run security-tests.json
# Stage 5: Deploy with security
deploy:
stage: deploy
script:
# Verify image signature
- cosign verify myapp:$CI_COMMIT_SHA
# Apply security policies
- kubectl apply -f k8s/policies/
# Deploy application
- kubectl apply -f k8s/production/
# Verify deployment security
- kube-bench run --targets master,node
Vulnerability Management Process
1. DISCOVERY
└── Scan code, dependencies, containers, infrastructure
2. PRIORITIZATION
├── Severity assessment (CVSS score)
├── Exploitability analysis
├── Business impact evaluation
└── Risk scoring
3. TRIAGE
├── Assign ownership
├── Set SLA based on severity
├── Create remediation tickets
└── Track in vulnerability management system
4. REMEDIATION
├── Update dependencies
├── Apply patches
├── Implement workarounds
└── Verify fixes
5. VALIDATION
├── Re-scan to confirm fix
├── Test for regressions
└── Close vulnerability ticket
6. REPORTING
├── Update security dashboard
├── Notify stakeholders
└── Document lessons learned
Security Patterns
Defense in Depth
Layer 1: Network Security
├── Firewall rules
├── Network segmentation
├── DDoS protection
└── WAF (Web Application Firewall)
Layer 2: Application Security
├── Input validation
├── Output encoding
├── Authentication & authorization
└── Session management
Layer 3: Data Security
├── Encryption at rest
├── Encryption in transit
├── Data masking
└── Access controls
Layer 4: Infrastructure Security
├── OS hardening
├── Patch management
├── Security configuration
└── Vulnerability scanning
Layer 5: Monitoring & Response
├── Security logging
├── SIEM
├── Incident response
└── Threat intelligence
Zero Trust Architecture
1. VERIFY EXPLICITLY
├── Authenticate every request
├── Authorize based on all data points
└── Use multi-factor authentication
2. LEAST PRIVILEGE ACCESS
├── Just-in-time access
├── Risk-based adaptive policies
└── Data protection
3. ASSUME BREACH
├── Minimize blast radius
├── Segment access
├── End-to-end encryption
└── Analytics for visibility
Security by Technology Stack
React/TypeScript
Security Concerns:
- XSS vulnerabilities
- Dependency vulnerabilities
- API security
- Authentication token storage
Tools & Practices:
# Dependency scanning
npm audit
snyk test
# SAST scanning
eslint --plugin security
semgrep --config=p/react
# Content Security Policy
# Add to HTML or headers
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'
Secure Coding:
// ✅ GOOD: Sanitize user input
import DOMPurify from 'dompurify';
const SafeComponent: React.FC<{html: string}> = ({html}) => {
const sanitized = DOMPurify.sanitize(html);
return <div dangerouslySetInnerHTML={{__html: sanitized}} />;
};
// ❌ BAD: Direct use of dangerouslySetInnerHTML
const UnsafeComponent = ({html}) => (
<div dangerouslySetInnerHTML={{__html: html}} />
);
// ✅ GOOD: Secure token storage
// Store JWT in httpOnly cookie, not localStorage
// Use secure, sameSite=strict cookies
// ❌ BAD: Storing tokens in localStorage
localStorage.setItem('token', jwt); // Vulnerable to XSS
Python/FastAPI
Security Concerns:
- SQL injection
- Command injection
- Insecure deserialization
- Dependency vulnerabilities
Tools & Practices:
# Dependency scanning
safety check
pip-audit
snyk test --file=requirements.txt
# SAST scanning
bandit -r .
semgrep --config=p/python
# Secret scanning
detect-secrets scan
Secure Coding:
# ✅ GOOD: Use parameterized queries
from sqlalchemy import text
def get_user(user_id: int):
query = text("SELECT * FROM users WHERE id = :id")
result = db.execute(query, {"id": user_id})
return result.first()
# ❌ BAD: String concatenation (SQL injection)
def get_user_unsafe(user_id: str):
query = f"SELECT * FROM users WHERE id = {user_id}"
return db.execute(query)
# ✅ GOOD: Input validation
from pydantic import BaseModel, validator
class UserCreate(BaseModel):
email: str
password: str
@validator('password')
def validate_password(cls, v):
if len(v) < 8:
raise ValueError('Password must be at least 8 characters')
return v
# ✅ GOOD: Rate limiting
from slowapi import Limiter
from slowapi.util import get_remote_address
limiter = Limiter(key_func=get_remote_address)
@app.post("/api/login")
@limiter.limit("5/minute")
async def login(credentials: LoginRequest):
return await authenticate(credentials)
Java/Spring Boot
Security Concerns:
- Deserialization vulnerabilities
- XXE (XML External Entity)
- LDAP injection
- Dependency vulnerabilities
Tools & Practices:
# Dependency scanning
mvn dependency-check:check
snyk test
# SAST scanning
spotbugs -effort:max -low
semgrep --config=p/java
# Container scanning
trivy image myapp:latest
Secure Coding:
// ✅ GOOD: Use prepared statements
public User getUserById(int userId) {
String sql = "SELECT * FROM users WHERE id = ?";
return jdbcTemplate.queryForObject(sql, new Object[]{userId},
new UserRowMapper());
}
// ❌ BAD: String concatenation
public User getUserByIdUnsafe(int userId) {
String sql = "SELECT * FROM users WHERE id = " + userId;
return jdbcTemplate.queryForObject(sql, new UserRowMapper());
}
// ✅ GOOD: Spring Security configuration
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.and()
.authorizeRequests()
.antMatchers("/api/public/**").permitAll()
.anyRequest().authenticated()
.and()
.oauth2ResourceServer().jwt();
return http.build();
}
}
// ✅ GOOD: Secure password hashing
@Service
public class PasswordService {
private final PasswordEncoder encoder = new BCryptPasswordEncoder(12);
public String hashPassword(String plainPassword) {
return encoder.encode(plainPassword);
}
}
Kubernetes/Docker
Security Concerns:
- Container breakout
- Privilege escalation
- Insecure configurations
- Supply chain attacks
Tools & Practices:
# Container scanning
trivy image nginx:latest
docker scan nginx:latest
grype nginx:latest
# K8s security scanning
kubesec scan pod.yaml
kube-bench
kube-hunter
# Policy enforcement
kubectl apply -f pod-security-policy.yaml
gatekeeper install
Secure Configurations:
# ✅ GOOD: Secure Pod configuration
apiVersion: v1
kind: Pod
metadata:
name: secure-pod
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
seccompProfile:
type: RuntimeDefault
containers:
- name: app
image: myapp:latest
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
capabilities:
drop:
- ALL
resources:
limits:
cpu: "1"
memory: "512Mi"
requests:
cpu: "0.5"
memory: "256Mi"
livenessProbe:
httpGet:
path: /health
port: 8080
readinessProbe:
httpGet:
path: /ready
port: 8080
# ✅ GOOD: Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: api-network-policy
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: database
ports:
- protocol: TCP
port: 5432
Security Tools Integration
GitHub Actions Security Pipeline
name: Security Pipeline
on: [push, pull_request]
jobs:
secret-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: TruffleHog Secret Scan
uses: trufflesecurity/trufflehog@main
with:
path: ./
base: ${{ github.event.repository.default_branch }}
head: HEAD
sast:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run Semgrep
uses: returntocorp/semgrep-action@v1
with:
config: >-
p/security-audit
p/secrets
p/owasp-top-ten
- name: Run CodeQL
uses: github/codeql-action/analyze@v2
dependency-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run Snyk
uses: snyk/actions/node@master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=high
container-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Build image
run: docker build -t myapp:${{ github.sha }} .
- name: Run Trivy
uses: aquasecurity/trivy-action@master
with:
image-ref: myapp:${{ github.sha }}
format: 'sarif'
output: 'trivy-results.sarif'
- name: Upload results
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
iac-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run Checkov
uses: bridgecrewio/checkov-action@master
with:
directory: infrastructure/
framework: terraform
output_format: sarif
output_file_path: checkov-results.sarif
GitLab CI Security Pipeline
include:
- template: Security/SAST.gitlab-ci.yml
- template: Security/Secret-Detection.gitlab-ci.yml
- template: Security/Dependency-Scanning.gitlab-ci.yml
- template: Security/Container-Scanning.gitlab-ci.yml
- template: Security/DAST.gitlab-ci.yml
variables:
SECURE_LOG_LEVEL: "debug"
stages:
- test
- security
- deploy
security-scan:
stage: security
image: securego/gosec:latest
script:
- gosec -fmt json -out gosec-report.json ./...
artifacts:
reports:
sast: gosec-report.json
custom-container-scan:
stage: security
image: aquasec/trivy:latest
script:
- trivy image --exit-code 1 --severity CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
Compliance Frameworks
SOC 2 Type II
Key Controls:
CC6.1: Logical and Physical Access Controls
├── Multi-factor authentication
├── Password policies
├── Access reviews (quarterly)
└── Privileged access management
CC6.2: System Monitoring
├── Security logging enabled
├── Log retention (1 year)
├── SIEM implementation
└── Anomaly detection
CC7.1: Threat Detection
├── Vulnerability scanning (weekly)
├── Penetration testing (annual)
├── Security awareness training
└── Incident response plan
CC7.2: Infrastructure Security
├── Network segmentation
├── Encryption at rest and in transit
├── Patch management
└── Configuration management
PCI-DSS
Requirements:
Requirement 1: Firewall Configuration
├── Network diagram documentation
├── Firewall rule reviews (6 months)
└── DMZ implementation
Requirement 2: System Security
├── Change default passwords
├── Disable unnecessary services
└── Security configuration standards
Requirement 3: Protect Cardholder Data
├── Data encryption
├── Minimize data retention
└── Secure key management
Requirement 6: Secure Development
├── Security training for developers
├── SAST/DAST scanning
├── Code review process
└── Vulnerability management
Requirement 10: Logging and Monitoring
├── Audit trails
├── Log review
├── Time synchronization
└── Log protection
Requirement 11: Security Testing
├── Quarterly vulnerability scans
├── Annual penetration testing
├── IDS/IPS deployment
└── File integrity monitoring
Security Metrics & KPIs
Key Metrics to Track
1. VULNERABILITY METRICS
├── Mean Time to Detect (MTTD): < 24 hours
├── Mean Time to Remediate (MTTR): < 30 days (critical), < 90 days (high)
├── Vulnerability density: # of vulnerabilities per 1000 lines of code
└── False positive rate: < 10%
2. SECURITY TESTING COVERAGE
├── Code coverage by SAST: > 80%
├── API endpoints covered by DAST: > 90%
├── Dependencies scanned: 100%
└── Containers scanned: 100%
3. PIPELINE SECURITY
├── Security gate failures: Track trend
├── Time added by security scans: < 10% of total build time
├── Security exceptions granted: < 5% of findings
└── Pipeline security incidents: 0
4. INCIDENT RESPONSE
├── Security incidents: Track count and trend
├── Incident response time: < 1 hour
├── Incident resolution time: Based on severity
└── Post-incident reviews completed: 100%
5. COMPLIANCE
├── Policy compliance rate: > 95%
├── Audit findings: Track and trend
├── Training completion: 100% annually
└── Access reviews completed: 100% quarterly
Security Dashboard
┌─────────────────────────────────────────────┐
│ SECURITY DASHBOARD │
├─────────────────────────────────────────────┤
│ Vulnerability Status │
│ ┌─────────────────────────────────────────┐ │
│ │ Critical: 3 ⚠️ (↓ 2 from last week) │ │
│ │ High: 12 ⚠️ (↑ 3 from last week) │ │
│ │ Medium: 45 ℹ️ │ │
│ │ Low: 128 ℹ️ │ │
│ └─────────────────────────────────────────┘ │
│ │
│ Mean Time to Remediate │
│ ┌─────────────────────────────────────────┐ │
│ │ Critical: 5 days ✅ (Target: < 7) │ │
│ │ High: 18 days ✅ (Target: < 30) │ │
│ │ Medium: 45 days ⚠️ (Target: < 60) │ │
│ └─────────────────────────────────────────┘ │
│ │
│ Security Scan Coverage │
│ ┌─────────────────────────────────────────┐ │
│ │ SAST: 87% ✅ │ │
│ │ SCA: 100% ✅ │ │
│ │ DAST: 75% ⚠️ │ │
│ │ Container: 100% ✅ │ │
│ └─────────────────────────────────────────┘ │
└─────────────────────────────────────────────┘
Best Practices
1. Shift Security Left
- Integrate security early in SDLC
- Provide security training to developers
- Use IDE security plugins
- Implement pre-commit hooks
2. Automate Everything
- Automated security scanning in CI/CD
- Automated vulnerability management
- Automated compliance checks
- Infrastructure as code
3. Defense in Depth
- Multiple layers of security controls
- Assume each layer can be breached
- Redundant security mechanisms
- Principle of least privilege
4. Continuous Monitoring
- Real-time security monitoring
- Automated alerting
- Log aggregation and analysis
- Threat intelligence integration
5. Fail Securely
- Secure defaults
- Fail closed, not open
- Error messages don't leak information
- Graceful degradation
6. Security as Code
- Policy as code
- Automated compliance testing
- Version controlled security configs
- Immutable infrastructure
7. Regular Testing
- Automated security testing
- Penetration testing
- Red team exercises
- Chaos engineering for security
8. Incident Response Preparedness
- Documented incident response plan
- Regular drills and tabletop exercises
- Clear escalation procedures
- Post-incident reviews
9. Supply Chain Security
- Verify software provenance
- Sign and verify artifacts
- SBOM (Software Bill of Materials)
- Dependency pinning and updates
10. Security Culture
- Security champions program
- Regular security training
- Blameless post-mortems
- Security metrics visibility
Common Security Vulnerabilities
OWASP Top 10 (2021)
A01:2021 – Broken Access Control
Prevention:
- Implement proper authorization checks
- Deny by default
- Test access controls thoroughly
- Log access control failures
A02:2021 – Cryptographic Failures
Prevention:
- Use strong encryption (AES-256, RSA-2048+)
- Implement TLS 1.3
- Secure key management
- Don't store sensitive data unnecessarily
A03:2021 – Injection
Prevention:
- Use parameterized queries
- Validate and sanitize input
- Use ORM frameworks
- Implement WAF
A04:2021 – Insecure Design
Prevention:
- Threat modeling
- Secure design patterns
- Security requirements in user stories
- Security architecture review
A05:2021 – Security Misconfiguration
Prevention:
- Automated configuration management
- Remove default credentials
- Disable unnecessary features
- Regular security audits
A06:2021 – Vulnerable and Outdated Components
Prevention:
- Dependency scanning
- Regular updates
- Remove unused dependencies
- Monitor CVE databases
A07:2021 – Identification and Authentication Failures
Prevention:
- Multi-factor authentication
- Strong password policies
- Session management
- Rate limiting
A08:2021 – Software and Data Integrity Failures
Prevention:
- Digital signatures
- Verify integrity of updates
- Secure CI/CD pipeline
- Supply chain security
A09:2021 – Security Logging and Monitoring Failures
Prevention:
- Comprehensive logging
- Real-time monitoring
- Automated alerting
- Log protection
A10:2021 – Server-Side Request Forgery (SSRF)
Prevention:
- Input validation
- Network segmentation
- Whitelist allowed destinations
- Disable unused URL schemas
When to Use This Skill
Use the DevSecOps skill when you need to:
- ✅ Implement security in CI/CD pipelines
- ✅ Set up vulnerability scanning
- ✅ Configure container security
- ✅ Manage secrets securely
- ✅ Implement compliance controls
- ✅ Design secure architectures
- ✅ Respond to security incidents
- ✅ Perform security code reviews
- ✅ Set up security monitoring
- ✅ Automate security testing
- ✅ Implement zero trust architecture
- ✅ Secure cloud infrastructure
- ✅ Configure authentication/authorization
- ✅ Implement encryption
- ✅ Conduct threat modeling
Examples
Example 1: Setting Up Security Pipeline
Request: "Set up a complete security scanning pipeline for a Python FastAPI application"
Response:
# .github/workflows/security.yml
name: Security Pipeline
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
schedule:
- cron: '0 0 * * 0' # Weekly scan
jobs:
secret-scanning:
name: Secret Detection
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Gitleaks Scan
uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
dependency-scanning:
name: Dependency Vulnerabilities
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.11'
- name: Install dependencies
run: |
pip install -r requirements.txt
pip install safety pip-audit
- name: Safety Check
run: safety check --json > safety-report.json
continue-on-error: true
- name: Pip Audit
run: pip-audit --format json > pip-audit-report.json
- name: Snyk Test
uses: snyk/actions/python@master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=high
sast-scanning:
name: Static Code Analysis
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Bandit Security Scan
run: |
pip install bandit[toml]
bandit -r . -f json -o bandit-report.json
- name: Semgrep Scan
uses: returntocorp/semgrep-action@v1
with:
config: >-
p/python
p/owasp-top-ten
p/security-audit
container-scanning:
name: Container Security
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Build Docker Image
run: docker build -t myapp:${{ github.sha }} .
- name: Trivy Scan
uses: aquasecurity/trivy-action@master
with:
image-ref: myapp:${{ github.sha }}
format: 'sarif'
severity: 'CRITICAL,HIGH'
exit-code: '1'
- name: Grype Scan
uses: anchore/scan-action@v3
with:
image: myapp:${{ github.sha }}
fail-build: true
severity-cutoff: high
api-security-testing:
name: DAST - API Security
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Start Application
run: |
docker-compose up -d
sleep 10
- name: OWASP ZAP API Scan
uses: zaproxy/action-api-scan@v0.4.0
with:
target: 'http://localhost:8000/openapi.json'
fail_action: true
- name: Stop Application
run: docker-compose down
security-report:
name: Generate Security Report
needs: [secret-scanning, dependency-scanning, sast-scanning, container-scanning]
runs-on: ubuntu-latest
steps:
- name: Collect Results
run: echo "Security scans completed"
- name: Post to Slack
uses: slackapi/slack-github-action@v1
with:
payload: |
{
"text": "Security scan completed for ${{ github.repository }}"
}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
Example 2: Kubernetes Security Hardening
Request: "Harden Kubernetes deployment for production"
Response provided in examples folder (see EXAMPLES.md)
Example 3: Implementing Secrets Management
Request: "Set up secure secrets management with HashiCorp Vault"
Response provided in examples folder (see EXAMPLES.md)
Resources
Tools
SAST:
- SonarQube, Checkmarx, Veracode, Semgrep, CodeQL
SCA:
- Snyk, Dependabot, WhiteSource, Black Duck, OWASP Dependency-Check
DAST:
- OWASP ZAP, Burp Suite, Acunetix, Netsparker
Container Security:
- Trivy, Clair, Anchore, Aqua Security, Sysdig
IaC Security:
- Checkov, tfsec, Terrascan, Snyk IaC
Secrets Management:
- HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, CyberArk
Standards & Frameworks
- OWASP Top 10
- OWASP ASVS (Application Security Verification Standard)
- NIST Cybersecurity Framework
- CIS Benchmarks
- ISO 27001
- SOC 2
- PCI-DSS
Learning Resources
Note: Security is everyone's responsibility. This skill provides guidance, but always consult security professionals for critical systems and stay updated with the latest threats and mitigation strategies.
Converted and distributed by TomeVault — claim your Tome and manage your conversions.