DevSecOps
Security in CI/CD, shift-left security, infrastructure as code security, and DevSecOps tools.
Overview
DevSecOps integrates security throughout the development lifecycle.
DevSecOps Pipeline
Architecture Diagram
Code -> Build -> Test -> Deploy -> Monitor
| | | | |
SAST SCA DAST IaC Runtime
Lint Scan Scan Scan Protection
Shift-Left Security
# GitHub Actions security pipeline
name: Security Scan
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: SAST - CodeQL
uses: github/codeql-action/analyze@v2
- name: SCA - Snyk
uses: snyk/actions@master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
- name: Secret Scan - TruffleHog
uses: trufflesecurity/trufflehog@main
- name: IaC Scan - Checkov
uses: bridgecrewio/checkov-action@master
IaC Security
python
# Terraform security scanning
# terraform scan
# tfsec example
# tfsec . --format json --out results.json
# Checkov example
# checkov -d . --framework terraform
Container Security
# Secure Dockerfile
FROM alpine:3.18
# Don't run as root
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
# Scan for vulnerabilities
# trivy image myapp:latest
Secret Management
# Kubernetes secrets
apiVersion: v1
kind: Secret
metadata:
name: db-credentials
type: Opaque
data:
username: YWRtaW4=
password: cGFzc3dvcmQ=
Security Gates
| Stage | Gate | Criteria |
|---|---|---|
| Code | Pre-commit | No secrets |
| Build | SAST | No critical issues |
| Test | DAST | No high vulnerabilities |
| Deploy | Policy | Compliance check |
Practice
Implement a complete DevSecOps pipeline with security gates.