Setting Up a DevSecOps Program with Open Source Tools

Creating a DevSecOps program using open source tools can be a cost-effective solution for many organizations. It requires a combination of practices, tools, and cultural philosophies to ensure security is integrated into the development life cycle. In this process, remember to continuously review and update your DevSecOps program to keep up with evolving security threats and to adopt new and improved open source tools as they become available.

We can approach setting up a DevSecOps program with open source tools by following these steps. This is an exhaustive list of things that can be covered as part of setting up a DevSecOps program:

• Culture and training: Foster a culture of shared responsibility for security across your development, security, and operations teams. Conduct ongoing training to ensure all team members have the requisite knowledge to contribute to security.
• Version control: Adopt version control systems...

Techniques used in setting up the program

Let’s start by understanding the techniques that can be used in setting up the program. We will start by understanding DevSecOps.

Understanding DevSecOps

DevSecOps expands on the mindset established by DevOps, which is a set of cultural philosophies, practices, and tools that encourage faster and more agile software development through collaboration between development and operations teams.

The adoption of a DevSecOps culture requires a holistic approach and a commitment to continuous improvement to ensure that security is integrated effectively into the development life cycle, ultimately leading to more secure and reliable software delivery. At its core, DevSecOps means integrating security into every step of the development process. It’s a cultural shift, ensuring that security is everyone’s responsibility.

Let’s deep dive into understanding DevSecOps.

Cultural shift

DevSecOps fosters a culture...

Setting up the CI/CD pipeline

Use Jenkins or GitLab CI/CD as your CI/CD tool. These are popular open source tools that can automate the process of building, testing, and deploying your applications. Here are the stages where these tools can help:

• Source code management: Git is the most commonly used open source tool. Platforms such as GitHub and GitLab provide added features such as pull requests, issues, and CI/CD integrations.
• Static Application Security Testing (SAST): Use tools such as Brakeman (Ruby on Rails), Bandit (Python), or SonarQube to detect vulnerabilities in your source code.
• Dynamic Application Security Testing (DAST): Tools such as OWASP ZAP or Arachni can identify vulnerabilities at runtime by scanning your running application.
• Container security: If you’re using Docker, tools such as Clair, Anchore, or Trivy can scan your containers for known vulnerabilities.
• Dependency scanning: Check for vulnerabilities in your project’s dependencies...

Implementing security controls

DevSecOps programs ensure a proactive approach to security, making applications more resilient to attacks and ensuring compliance with industry standards and regulations.

Let’s understand how implementing security controls can help in the context of DevSecOps:

• Early detection: Catching vulnerabilities early reduces the cost and complexity of remediation
• Continuous security: With security integrated at every step, the application is continuously checked for vulnerabilities, ensuring a robust security posture
• Shared responsibility: Security becomes everyone’s responsibility, not just a siloed task for a security team
• Source code repository: Use pre-commit or pre-receive hooks to enforce certain security checks even before the code is pushed:
  • CI/CD pipeline integration: Help in automating the different phases and connecting the relevant tools.
  • Build stage: Check dependencies for vulnerabilities.
  • Test stage: Run SAST and...

Managing DevSecOps in production

DevSecOps in production involves not just deploying code but ensuring that the entire pipeline and the running applications remain secure, and compliant, and are continuously monitored for any potential threats or vulnerabilities. Security controls ensure that security measures are put in place to counteract vulnerabilities.

Also, by carefully managing DevSecOps in production, organizations can ensure that their applications remain secure, compliant, and resilient against potential threats. It requires proactive monitoring, adherence to compliance standards, and a reactive plan in place for when things go wrong.

Let’s break down them step by step.

Monitoring and managing the DevSecOps pipeline in production

• Pipeline monitoring: Keep an eye on the CI/CD pipeline itself to ensure that all security checks are being executed, and no step is bypassed
• Runtime monitoring: Continuously monitor the application in production for abnormal...

The benefits of the program

A DevSecOps program is beneficial not only for creating a secure software development and deployment process but also for fostering a security-centric organizational culture. This can lead to better product quality, increased trust from customers and stakeholders, and a more resilient digital infrastructure. It merges the principles of DevOps with security, ensuring that security is an integral part of the development and deployment processes.

Implementing a DevSecOps program can offer a wide range of benefits:

• Early detection of vulnerabilities: Identifying security flaws earlier in the development life cycle reduces the time and cost associated with mitigating them later
• Reduced attack surface: Continuous security checks and automated testing decrease the vulnerabilities that can be exploited
• Faster remediation: Immediate feedback and automation enable developers to fix security issues more swiftly
• Cost savings: Addressing vulnerabilities...

Summary

In this chapter, we covered DevSecOps as a cultural shift that embeds security into every phase of the development process, emphasizing that security is a shared responsibility across teams. We talked about how we can set up the CI/CD pipeline using open source tools such as Jenkins, GitLab CI/CD, and Travis CI to automate building, testing, and deploying applications, making it easier to incorporate security checks at each stage.

We also covered how to implement security controls:

• Importance: They provide early vulnerability detection and continuous security checks, and distribute the security responsibility across the team
• Tools: Various open source tools such as OWASP ZAP, Bandit, Trivy, and Checkov offer vulnerability scanning, configuration management, and more
• Integration: Security controls should be deeply integrated into the DevSecOps pipeline, ensuring timely detection and mitigation of vulnerabilities

Once deployed, the applications and pipeline...