DevOps and Security - DevSecOps

[monperrus]

Wikipedia references:

• https://en.wikipedia.org/wiki/Information_security
• https://en.wikipedia.org/wiki/Information_security_audit
• https://en.wikipedia.org/wiki/Attribute-based_access_control
• https://en.wikipedia.org/wiki/Penetration_test
• https://en.wikipedia.org/wiki/Intrusion_detection_system
• https://en.wikipedia.org/wiki/Runtime_application_self-protection
• https://en.wikipedia.org/wiki/Dynamic_application_security_testing
• https://en.wikipedia.org/wiki/Supply_chain_attack

[monperrus]

Principles:

• Complete Mediation Principle (useful for APIs)
• Least privileged

[monperrus]

Intrusion detection: https://en.wikipedia.org/wiki/Intrusion_detection_system

(signature based, anomaly detection)

[monperrus]

Very good set of pointers: https://www.sqreen.io/checklists/devops-security-checklist

[sbuc]

Mapping security design principles to devops on one axis, mapping security concepts/mechanisms to devops on another.

[lsc]

Dynamic and short lived secrets for authorisation, see for example AWS IAM Roles are implemented or Hashicorp Vault.

[monperrus]

Open Source: Simplifying Serverless Secrets
https://open.nytimes.com/open-source-simplifying-serverless-secrets-in-google-cloud-a95451e545b1

[bbaudry]

Vault and kubernetes
https://github.com/kelseyhightower/vault-on-google-kubernetes-engine

[monperrus]

CI/CD enables automated program hardening:

Operating system protection through program evolution, Fred Cohen, 1993

[monperrus]

Check your repos... Crypto-coin-stealing code sneaks into fairly popular NPM lib (2m downloads per week)
https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/

[monperrus]

7 Tips for Container and Kubernetes Security
http://lxer.com/module/newswire/ext_link.php?rid=264809

[gluckzhang]

Microservices Hierarchy of Needs
KUBERNETES: AN OVERVIEW (This is a nice introduction to Kubernetes architecture and advantages)

[monperrus]

On The Relation Between Outdated Docker Containers, Severity Vulnerabilities and Bugs.
http://arxiv.org/abs/1811.12874

[bbaudry]

Reproducible builds
https://reproducible-builds.org/

[monperrus]

added wikipedia references in the top post of this thread.