OWASP Devsecops Maturity Model

• Show your build pipeline and an exemplary job (build + test).
• Show that every team member has access.
• Show that failed jobs are fixed.

• CI/CD tools:
  • Container technologies and orchestration like Docker, Kubernetes

• CI/CD tools:
  • Container technologies and orchestration like Docker, Kubernetes

• Tags
• URL
• Description

• Signing of commits:
  • Tags
    • signing
  • URL
    • https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
  • Description
    • Signing of commits in git
• Enforcement of commit signing:
  • Tags
    • signing
  • URL
    • https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule
  • Description
    • Usage of branch protection rules

• Docker Content Trust:
  • Tags
  • URL
    • https://docs.docker.com/engine/security/trust/
  • Description
• in-toto
  • Tags
  • URL
    • https://in-toto.github.io/
  • Description

• CI/CD tools
  • Tags
    • ci-cd
  • URL
    • https://martinfowler.com/articles/continuousIntegration.html
  • Description
  • CI/CD tools such as jenkins, gitlab-ci or github-actions
• Docker
  • Tags
  • URL
    • https://github.com/moby/moby
  • Description

• Backstage
  • Tags
    • documentation
    • inventory
  • URL
    • https://github.com/backstage/backstage
  • Description
    • Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure.
• Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
  • Tags
    • sca
    • inventory
    • OpenSource
    • Supply Chain
    • vulnerability
    • inventory
  • URL
    • https://github.com/DependencyTrack/dependency-track
  • Description
• Image Metadata Collector
  • Tags
    • documentation
    • inventory
    • kubernetes
  • URL
    • https://github.com/SDA-SE/image-metadata-collector/
  • Description
    • Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API.

• Tags
• URL
• Description

• Kubernetes Admission Controller can whitelist registries and/or whitelist a signing key.
  • Tags
  • URL
    • https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d
  • Description
• packj
  • Tags
    • OpenSource
    • Supply Chain
    • vulnerability
  • URL
    • https://github.com/ossillate-inc/packj
  • Description
    • Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI.

• Backstage
  • Tags
    • documentation
    • inventory
  • URL
    • https://github.com/backstage/backstage
  • Description
    • Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure.
• Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
  • Tags
    • sca
    • inventory
    • OpenSource
    • Supply Chain
    • vulnerability
    • inventory
  • URL
    • https://github.com/DependencyTrack/dependency-track
  • Description
• Image Metadata Collector
  • Tags
    • documentation
    • inventory
    • kubernetes
  • URL
    • https://github.com/SDA-SE/image-metadata-collector/
  • Description
    • Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API.

• Backstage
  • Tags
    • documentation
    • inventory
  • URL
    • https://github.com/backstage/backstage
  • Description
    • Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure.
• Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
  • Tags
    • sca
    • inventory
    • OpenSource
    • Supply Chain
    • vulnerability
    • inventory
  • URL
    • https://github.com/DependencyTrack/dependency-track
  • Description
• Image Metadata Collector
  • Tags
    • documentation
    • inventory
    • kubernetes
  • URL
    • https://github.com/SDA-SE/image-metadata-collector/
  • Description
    • Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API.

• Docker
  • Tags
  • URL
    • https://github.com/moby/moby
  • Description
• Webserver
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:WebServer/
  • Description
• rolling update
  • Tags
  • URL
  • Description

• Docker
  • Tags
  • URL
    • https://github.com/moby/moby
  • Description

• Docker
  • Tags
  • URL
    • https://github.com/moby/moby
  • Description
• Feature Toggles
  • Tags
    • development
    • architecture
  • URL
    • https://martinfowler.com/articles/feature-toggles.html
  • Description
    • Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson)

• Blue/Green Deployments
  • Tags
  • URL
    • https://martinfowler.com/bliki/BlueGreenDeployment.html
  • Description

• Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform)

• dependabot
  • Tags
    • auto-pr
    • patching
  • URL
    • https://dependabot.com/
  • Description
• Jenkins
  • Tags
  • URL
    • https://www.jenkins.io/
  • Description
• terraform
  • Tags
    • IaC
  • URL
    • https://www.terraform.io/
  • Description
    • Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service.
• renovate
  • Tags
    • auto-pr
    • patching
  • URL
    • https://github.com/renovatebot/renovate
  • Description

• dependabot
  • Tags
    • auto-pr
    • patching
  • URL
    • https://dependabot.com/
  • Description
• renovate
  • Tags
    • auto-pr
    • patching
  • URL
    • https://github.com/renovatebot/renovate
  • Description

• Distroless
  • Tags
  • URL
    • https://github.com/GoogleContainerTools/distroless
  • Description
• Fedora CoreOS
  • Tags
  • URL
    • https://getfedora.org/coreos
  • Description
• Distroless or Alpine
  • Tags
  • URL
    • https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22
  • Description

• terraform
  • Tags
    • IaC
  • URL
    • https://www.terraform.io/
  • Description
    • Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service.
• argoCD
  • Tags
    • deployment
  • URL
    • https://argo-cd.readthedocs.io/en/stable/
  • Description

• Sample concept:
  • Tags
  • URL
  • Description
    • Sample concept:
      • (1) each container has a set lifetime and is killed / replaced with a new container multiple times a day where you have some form of a graceful replacement to ensure no (short) service outage will occur to the end users.
      • (2) twice a day a rebuild of images is done. The rebuilds are put into a automated testing pipeline. If the testing has no blocking issues the new images will be released for deployment during the next "restart" of a container. What has to be done, is to ensure the new containers are deployed in some canary deployment manner, this will ensure that if (and only if) something buggy has been introduced which breaks functionality the canary deployment will make sure the "older version" is being used and not the buggy newer one.

Note: A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below.

• Whiteboard
  • Tags
    • defender
    • threat-modeling
    • collaboration
    • whiteboard
  • URL
    • https://en.wikipedia.org/wiki/Whiteboard
  • Description
• Miro (or any other collaborative board)
  • Tags
    • defender
    • threat-modeling
    • collaboration
    • whiteboard
  • URL
    • https://miro.com/
  • Description
• Draw.io
  • Tags
    • defender
    • threat-modeling
    • whiteboard
  • URL
    • https://github.com/jgraph/drawio-desktop
  • Description
• Threat Modeling Playbook
  • Tags
    • owasp
    • defender
    • threat-modeling
    • whiteboard
  • URL
    • https://github.com/Toreon/threat-model-playbook
  • Description
• OWASP SAMM
  • Tags
    • threat-modeling
    • owasp
    • defender
  • URL
    • https://owaspsamm.org/model/design/threat-assessment/stream-b/
  • Description
• Threat Matrix for Storage
  • Tags
    • documentation
    • storage
    • cluster
    • kubernetes
  • URL
    • https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/
  • Description

• [Don't Forget EVIL U
  • Tags
  • URL
    • https://www.owasp.org/index.php/Agile_Software_Development
  • Description
    • Do not Forget EVIL User Stories and Practical Security Stories and Security Tasks for Agile Development Environments

• Threat Modeling Playbook
  • Tags
    • owasp
    • defender
    • threat-modeling
    • whiteboard
  • URL
    • https://github.com/Toreon/threat-model-playbook
  • Description
• OWASP SAMM
  • Tags
    • threat-modeling
    • owasp
    • defender
  • URL
    • https://owaspsamm.org/model/design/threat-assessment/stream-b/
  • Description

• Local encrypted caches need to expire and auto-purged.
• Communication channels encrypted and authenticated.
• All secrets persisted in shared secrets store.
• Frontend designed with permissions model integration.
• Permissions matrix defined.
• Input is escaped output is encoded appropriately using well established libraries.

• Whiteboard
  • Tags
    • defender
    • threat-modeling
    • collaboration
    • whiteboard
  • URL
    • https://en.wikipedia.org/wiki/Whiteboard
  • Description
• Miro (or any other collaborative board)
  • Tags
    • defender
    • threat-modeling
    • collaboration
    • whiteboard
  • URL
    • https://miro.com/
  • Description
• Draw.io
  • Tags
    • defender
    • threat-modeling
    • whiteboard
  • URL
    • https://github.com/jgraph/drawio-desktop
  • Description
• Threat Modeling Playbook
  • Tags
    • owasp
    • defender
    • threat-modeling
    • whiteboard
  • URL
    • https://github.com/Toreon/threat-model-playbook
  • Description
• OWASP SAMM
  • Tags
    • threat-modeling
    • owasp
    • defender
  • URL
    • https://owaspsamm.org/model/design/threat-assessment/stream-b/
  • Description
• Threagile
  • Tags
    • threat-modeling
  • URL
    • https://github.com/Threagile/threagile
  • Description
• Threat Matrix for Storage
  • Tags
    • documentation
    • storage
    • cluster
    • kubernetes
  • URL
    • https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/
  • Description

• [Don't Forget EVIL U
  • Tags
  • URL
    • https://www.owasp.org/index.php/Agile_Software_Development
  • Description
    • Do not Forget EVIL User Stories and Practical Security Stories and Security Tasks for Agile Development Environments

• OWASP Juice Shop
  • Tags
    • training
  • URL
    • https://github.com/bkimminich/juice-shop
  • Description
    • In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday"
• OWASP Cheatsheet Series
  • Tags
    • secure coding
  • URL
    • https://cheatsheetseries.owasp.org/
  • Description

• OWASP Cheatsheet Series
  • Tags
    • secure coding
  • URL
    • https://cheatsheetseries.owasp.org/
  • Description

• OWASP Security Champions Playbook
  • Tags
    • security champions
  • URL
    • https://github.com/c0rdis/security-champions-playbook
  • Description

• OWASP JuiceShop
  • Tags
  • URL
    • https://github.com/bkimminich/juice-shop
  • Description
    • In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday"
• OWASP Cheatsheet Series
  • Tags
    • secure coding
  • URL
    • https://cheatsheetseries.owasp.org/
  • Description

• OWASP Cheatsheet Series
  • Tags
    • secure coding
  • URL
    • https://cheatsheetseries.owasp.org/
  • Description

• Motivate people
  • Tags
    • security champions
    • gamification
    • nudging
  • URL
    • https://github.com/wurstbrot/security-pins
  • Description
    • Enhance motivation can be performed with the distribution of pins as a reward, see OWASP Security Pins Project
• OWASP Top 10 Maturity Categories for Security Champions
  • Tags
    • security champions
  • URL
    • https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx
  • Description

• New vulnerabilities may be found before reaching production.
• Old vulnerabilities are found and fixed.

• Crypto implementations / usage
• Parser, unparser
• System configuration
• Authentication, authorization
• Session management
• Request throttling
• :unicorn: (self-developed code, only used in that one software)

• Present the performed reviews (including participants, findings, consequences) and assess whether it is reasonable.

• CWE Top 25 Most Dangerous Software Weaknesses
  • Tags
    • documentation
    • threat
  • URL
    • https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html
  • Description

• Build it Break it Fix it Contest
  • Tags
  • URL
    • https://builditbreakit.org/
  • Description

• sammancoaching
  • Tags
    • documentation
    • coaching
    • education
  • URL
    • https://sammancoaching.org/
  • Description
    • Security coaches work with software development teams to help them adopt better security practices.

• All exploits happen via the user interface.
• No need for security/hacking tools.
• No need for deep technical or security knowledge.
• Use an insecure training app, e.g., DVWA or OWASP Juice Shop.
• Encourage active participation, e.g., use small groups.
• Allow enough time for everyone to run at least one exploit.
• The team gets an idea of how exploits can look like and how easy applications can be attacked.
• The team understands functional correct working software can be highly insecure and easy to exploit.

• OWASP Juice Shop
  • Tags
    • training
  • URL
    • https://github.com/bkimminich/juice-shop
  • Description
    • In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday"
• Damn Vulnerable Web Application
  • Tags
    • training
  • URL
  • Description
    • Simple Application with intended vulnerabilities. HTML based.

• Involve Security SME
  • Tags
  • URL
  • Description
    • Security SME are involved in discussion for requirements analysis, software design and sprint planning to provide guidance and suggestions.

• OWASP JuiceShop
  • Tags
  • URL
    • https://github.com/bkimminich/juice-shop
  • Description
    • In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday"
• https://cheatsheetseries.owasp.org/
  • Tags
    • training
    • secure coding
  • URL
    • https://cheatsheetseries.owasp.org/
  • Description

• Ensures accuracy and relevance of findings before they reach product teams
• Reduces false positives, saving development teams time and effort
• Might provides a layer of expertise in assessing the severity and impact of vulnerabilities

• Requires a sufficient number of skilled security engineers, which might be challenging for some organizations
• May slow down the process if security engineers are overloaded with validation tasks
• For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application

• Accelerates the process by immediately notifying product teams of potential vulnerabilities
• Empowers product teams to take swift action in addressing security issues Pushing Findings Directly to Product Teams Cons:
• Increases the workload on product teams, potentially leading to frustration

• Jira
  • Tags
    • documentation
    • issue
    • proprietary
  • URL
    • https://jira.atlassian.com/
  • Description
    • Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards.
• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• DefectDojo Client
  • Tags
    • Defectdojo
    • statistics
  • URL
    • https://github.com/SDA-SE/defectdojo-client
  • Description
    • This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner.

• OWASP Application Security Verification Standard Level 1
• OWASP Mobile Application Security Verification Standard

• OWASP ASVS
  • Tags
  • URL
    • https://owasp.org/www-project-application-security-verification-standard/
  • Description
• OWASP MASVS
  • Tags
  • URL
    • https://github.com/OWASP/owasp-masvs
  • Description
• API Security Maturity Model for Authorization
  • Tags
    • api
  • URL
    • https://curity.io/resources/learn/the-api-security-maturity-model/
  • Description

• OWASP Application Security Verification Standard Level 1
• OWASP Mobile Application Security Verification Standard

• OWASP ASVS
  • Tags
  • URL
    • https://owasp.org/www-project-application-security-verification-standard/
  • Description
• OWASP MASVS
  • Tags
  • URL
    • https://github.com/OWASP/owasp-masvs
  • Description
• API Security Maturity Model for Authorization
  • Tags
    • api
  • URL
    • https://curity.io/resources/learn/the-api-security-maturity-model/
  • Description

• OWASP Application Security Verification Standard Level 2
• OWASP Mobile Application Security Verification Standard Level 2

• OWASP ASVS
  • Tags
  • URL
    • https://owasp.org/www-project-application-security-verification-standard/
  • Description
• OWASP MASVS
  • Tags
  • URL
    • https://github.com/OWASP/owasp-masvs
  • Description

• OWASP Application Security Verification Standard Level 2
• OWASP Mobile Application Security Verification Standard Level 2

• OWASP ASVS
  • Tags
  • URL
    • https://owasp.org/www-project-application-security-verification-standard/
  • Description
• OWASP MASVS
  • Tags
  • URL
    • https://github.com/OWASP/owasp-masvs
  • Description

• OWASP Application Security Verification Standard Level 3
• OWASP Mobile Application Security Verification Standard

• OWASP ASVS
  • Tags
  • URL
    • https://owasp.org/www-project-application-security-verification-standard/
  • Description
• OWASP MASVS
  • Tags
  • URL
    • https://github.com/OWASP/owasp-masvs
  • Description

• Improve code quality with branch policies
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops
  • Description
• About protected branches
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches
  • Description

• Improve code quality with branch policies
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops
  • Description
• About protected branches
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches
  • Description

• Improve code quality with branch policies
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops
  • Description
• About protected branches
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches
  • Description
• Enforcement of commit signing
  • Tags
    • signing
  • URL
    • https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule
  • Description
    • Usage of branch protection rules

• Improve code quality with branch policies
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops
  • Description
• About protected branches
  • Tags
    • source-code-protection
    • scm
  • URL
    • https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches
  • Description
• Enforcement of commit signing
  • Tags
    • signing
  • URL
    • https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule
  • Description
    • Usage of branch protection rules

• How to enforce a consistent coding style in your projects
  • Tags
    • ide
    • linting
  • URL
    • https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm
  • Description
• In-Depth Linting of Your TypeScript While Coding
  • Tags
    • ide
    • linting
  • URL
    • https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding
  • Description

• Smartcard
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/
  • Description
• YubiKey
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/
  • Description
• SMS
  • Tags
  • URL
  • Description
• TOTP
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:One-timePassword/
  • Description

• HTTP-Basic Authentication
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/
  • Description
• VPN
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:VPN/
  • Description

• A complete backup of persisted data might be performed*.
  • Tags
  • URL
  • Description
• A Point in Time Recovery for databases should be implemented.
  • Tags
  • URL
  • Description

• CIS Kubernetes Bench for Security
  • Tags
  • URL
    • https://www.cisecurity.org/cis-benchmarks/
  • Description
• CIS Docker Bench for Security
  • Tags
  • URL
    • https://www.cisecurity.org/cis-benchmarks/
  • Description
• For example for Cont
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/
  • Description
    • For example for Containers: Deny running containers as root, deny using advanced privileges, deny mounting of the hole filesystem, ...
• Attack Matrix Cloud
  • Tags
    • mitre
  • URL
    • https://attack.mitre.org/matrices/enterprise/cloud/
  • Description
    • Attack matrix for cloud
• Attack Matrix Containers
  • Tags
    • mitre
  • URL
    • https://attack.mitre.org/matrices/enterprise/cloud/
  • Description
    • Attack matrix for containers
• Attack Matrix Kubernetes
  • Tags
    • mitre
  • URL
    • https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  • Description
    • Attack matrix for kubernetes
• Defend the core kubernetes security at every layer
  • Tags
    • documentation
    • cluster
    • kubernetes
  • URL
    • https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/
  • Description

• istio
  • Tags
  • URL
    • https://istio.io/
  • Description
• bridges
  • Tags
  • URL
  • Description
• firewalls
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:Firewall/
  • Description

• Smartcard
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/
  • Description
• YubiKey
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/
  • Description
• SMS
  • Tags
  • URL
  • Description
• TOTP
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:One-timePassword/
  • Description

• Open Policy Agent
  • Tags
  • URL
    • https://www.openpolicyagent.org/
  • Description
• firewalls
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:Firewall/
  • Description

• Remove direct access to infrastructure
  • Tags
  • URL
  • Description

• GitOps
  • Tags
  • URL
    • https://www.redhat.com/en/topics/devops/what-is-gitops
  • Description
• Ansible
  • Tags
  • URL
    • https://github.com/ansible/ansible
  • Description
• Chef
  • Tags
  • URL
    • https://github.com/chef/chef
  • Description
• Puppet
  • Tags
  • URL
    • https://github.com/puppetlabs/puppet
  • Description
• Jenkinsfile
  • Tags
  • URL
    • https://www.jenkins.io/doc/book/pipeline/jenkinsfile/
  • Description

• seccomp
  • Tags
  • URL
    • https://man7.org/linux/man-pages/man2/seccomp.2.html
  • Description
• strace
  • Tags
  • URL
    • https://man7.org/linux/man-pages/man1/strace.1.html
  • Description
• Falco
  • Tags
    • falco
    • systemcall
    • monitoring
  • URL
    • https://github.com/falcosecurity/falco
  • Description
    • Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack.

• Directory Service
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/
  • Description
• Plugins
  • Tags
  • URL
  • Description

• For applications: Check default encoding
  • Tags
  • URL
  • Description
• managing secrets
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:CredentialHardening/
  • Description
• crypto
  • Tags
  • URL
  • Description
• authentication
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:Authentication/
  • Description

• CIS Kubernetes Bench for Security
  • Tags
  • URL
    • https://www.cisecurity.org/cis-benchmarks/
  • Description
• CIS Docker Bench for Security
  • Tags
  • URL
    • https://www.cisecurity.org/cis-benchmarks/
  • Description
• For example for Cont
  • Tags
  • URL
    • https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/
  • Description
    • For example for Containers: Deny running containers as root, deny using advanced privileges, deny mounting of the hole filesystem, ...
• Attack Matrix Cloud
  • Tags
    • mitre
  • URL
    • https://attack.mitre.org/matrices/enterprise/cloud/
  • Description
    • Attack matrix for cloud
• Attack Matrix Containers
  • Tags
    • mitre
  • URL
    • https://attack.mitre.org/matrices/enterprise/cloud/
  • Description
    • Attack matrix for containers
• Attack Matrix Kubernetes
  • Tags
    • mitre
  • URL
    • https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  • Description
    • Attack matrix for kubernetes
• Defend the core kubernetes security at every layer
  • Tags
    • documentation
    • cluster
    • kubernetes
  • URL
    • https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/
  • Description

• rsyslog
  • Tags
    • tool
    • logging
  • URL
    • https://www.rsyslog.com/
  • Description
• logstash
  • Tags
    • tool
    • logging
  • URL
    • https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html
  • Description

• successful/failed login/logout
• creation, change, and deletion of users
• errors during input validation and output creation
• exceptions and errors with security in their name
• transactions of value (e.g., financial transactions, costly operations)
• :unicorn: (special things of your application)

• No track of security-relevant events makes it harder to analyze an incident.
• Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal.

• Show which events are logged.
• Show a test for one event logging.

• logstash
  • Tags
    • tool
    • logging
  • URL
    • https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html
  • Description
• fluentd
  • Tags
    • tool
  • URL
    • https://www.fluentd.org/
  • Description
• bash
  • Tags
    • tool
  • URL
    • https://www.gnu.org/software/bash/
  • Description
• OWASP Logging CheatSheet
  • Tags
    • logging
    • documentation
  • URL
    • https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html
  • Description

• ELK-Stack
  • Tags
  • URL
    • https://www.elastic.co/elk-stack
  • Description

• rsyslog
  • Tags
    • tool
    • logging
  • URL
    • https://www.rsyslog.com/
  • Description
• logstash
  • Tags
    • tool
    • logging
  • URL
    • https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html
  • Description
• fluentd
  • Tags
    • tool
  • URL
    • https://www.fluentd.org/
  • Description
• bash
  • Tags
    • tool
  • URL
    • https://www.gnu.org/software/bash/
  • Description

• Prometheus
  • Tags
  • URL
    • https://prometheus.io/
  • Description

• collected
  • Tags
  • URL
  • Description

• collected
  • Tags
  • URL
  • Description

• Falco
  • Tags
    • falco
    • systemcall
    • monitoring
  • URL
    • https://github.com/falcosecurity/falco
  • Description
    • Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack.

• https://ht.transpare
  • Tags
  • URL
    • https://ht.transparencytoolkit.org/FileServer/FileServer/OLD
  • Description
    • https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf

• Cloud provider (if insights are possible)
• Runtimes, e.g. Kubernetes nodes
• Base images and container images
• Application

• Cloud provider
• Runtime, e.g. Kubernetes
• Base images and container images
• Application

• Ensures accuracy and relevance of findings before they reach product teams
• Reduces false positives, saving development teams time and effort
• Might provides a layer of expertise in assessing the severity and impact of vulnerabilities

• Requires a sufficient number of skilled security engineers, which might be challenging for some organizations
• May slow down the process if security engineers are overloaded with validation tasks
• For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application

• Accelerates the process by immediately notifying product teams of potential vulnerabilities
• Empowers product teams to take swift action in addressing security issues Pushing Findings Directly to Product Teams Cons:
• Increases the workload on product teams, potentially leading to frustration

• Jira
  • Tags
    • documentation
    • issue
    • proprietary
  • URL
    • https://jira.atlassian.com/
  • Description
    • Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards.
• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• DefectDojo Client
  • Tags
    • Defectdojo
    • statistics
  • URL
    • https://github.com/SDA-SE/defectdojo-client
  • Description
    • This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner.

• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• Business friendly vulnerability management metrics
  • Tags
    • documentation
    • vulnerability
    • vulnerability management system
  • URL
    • https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705
  • Description
• DefectDojo Client
• Tags
  • Defectdojo
  • statistics
  • URL
    • https://github.com/SDA-SE/defectdojo-client
  • Description
    • This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner

• Ensures accuracy and relevance of findings before they reach product teams
• Reduces false positives, saving development teams time and effort
• Might provides a layer of expertise in assessing the severity and impact of vulnerabilities

• Requires a sufficient number of skilled security engineers, which might be challenging for some organizations
• May slow down the process if security engineers are overloaded with validation tasks
• For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application

• Accelerates the process by immediately notifying product teams of potential vulnerabilities
• Empowers product teams to take swift action in addressing security issues Pushing Findings Directly to Product Teams Cons:
• Increases the workload on product teams, potentially leading to frustration

• Jira
  • Tags
    • documentation
    • issue
    • proprietary
  • URL
    • https://jira.atlassian.com/
  • Description
    • Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards.
• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• DefectDojo Client
  • Tags
    • Defectdojo
    • statistics
  • URL
    • https://github.com/SDA-SE/defectdojo-client
  • Description
    • This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner.

• JUnit
  • Tags
    • unittest
  • URL
    • https://junit.org/junit5/
  • Description
• Karma
  • Tags
  • URL
    • https://karma-runner.github.io
  • Description

• OWASP Defect Dojo
  • Tags
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.

• OWASP Dependency Check
  • Tags
    • OpenSource
    • Supply Chain
    • vulnerability
  • URL
    • https://owasp.org/www-project-dependency-check/
  • Description
• Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
  • Tags
    • sca
    • inventory
    • OpenSource
    • Supply Chain
    • vulnerability
    • inventory
  • URL
    • https://github.com/DependencyTrack/dependency-track
  • Description
• LogParser Jenkins Plugins
  • Tags
  • URL
  • Description
• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.

• Whether the asset is internet-facing (highly recommended)
• The number of network hops required to reach the asset (recommended)
• Authentication requirements for access (recommended)

• Ensures accuracy and relevance of findings before they reach product teams
• Reduces false positives, saving development teams time and effort
• Might provides a layer of expertise in assessing the severity and impact of vulnerabilities

• Requires a sufficient number of skilled security engineers, which might be challenging for some organizations
• May slow down the process if security engineers are overloaded with validation tasks
• For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application

• Accelerates the process by immediately notifying product teams of potential vulnerabilities
• Empowers product teams to take swift action in addressing security issues Pushing Findings Directly to Product Teams Cons:
• Increases the workload on product teams, potentially leading to frustration

• Jira
  • Tags
    • documentation
    • issue
    • proprietary
  • URL
    • https://jira.atlassian.com/
  • Description
    • Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards.
• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• DefectDojo Client
  • Tags
    • Defectdojo
    • statistics
  • URL
    • https://github.com/SDA-SE/defectdojo-client
  • Description
    • This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner.

• SAST
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/
  • Description
    • At SAST (Static Application Security Testing): Server-side / client-side teams can easily be recorded. With microservice architecture individual microservices can be used usually Teams.
• DAST
  • Tags
  • URL
    • https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/
  • Description
    • At DAST (Dynamic Application Security Testing): vulnerabilities are classified and can be assigned to server-side and client-side teams.

• Ensures accuracy and relevance of findings before they reach product teams
• Reduces false positives, saving development teams time and effort
• Might provides a layer of expertise in assessing the severity and impact of vulnerabilities

• Requires a sufficient number of skilled security engineers, which might be challenging for some organizations
• May slow down the process if security engineers are overloaded with validation tasks
• For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application

• Accelerates the process by immediately notifying product teams of potential vulnerabilities
• Empowers product teams to take swift action in addressing security issues Pushing Findings Directly to Product Teams Cons:
• Increases the workload on product teams, potentially leading to frustration

• Jira
  • Tags
    • documentation
    • issue
    • proprietary
  • URL
    • https://jira.atlassian.com/
  • Description
    • Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards.
• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• DefectDojo Client
  • Tags
    • Defectdojo
    • statistics
  • URL
    • https://github.com/SDA-SE/defectdojo-client
  • Description
    • This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner.

• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• SecObserve
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/MaibornWolff/SecObserve
  • Description
    • The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools.

• OWASP DefectDojo
  • Tags
    • vulnerability management system
    • owasp
  • URL
    • https://github.com/DefectDojo/django-DefectDojo
  • Description
    • DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo.
• Purify
  • Tags
    • vulnerability management system
  • URL
    • https://github.com/faloker/purify/
  • Description
    • The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
• Business friendly vulnerability management metrics
  • Tags
    • documentation
    • vulnerability
    • vulnerability management system
  • URL
    • https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705
  • Description

• Ajax Spider
  • Tags
  • URL
    • https://www.zaproxy.org/docs/desktop/addons/ajax-spider/
  • Description

• OWASP Zap
  • Tags
    • vulnerability
    • scanner
  • URL
    • https://github.com/zaproxy/zaproxy
  • Description
    • The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ...
• Arachni
  • Tags
  • URL
    • https://github.com/Arachni/arachni
  • Description

• Zest
  • Tags
    • zap
  • URL
    • https://www.zaproxy.org/docs/desktop/addons/zest/
  • Description
    • Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tool.

• cURL
  • Tags
  • URL
    • https://curl.se/
  • Description
• OpenAPI Specifications
  • Tags
  • URL
    • https://spec.openapis.org/
  • Description
• OWASP Zap
  • Tags
    • vulnerability
    • scanner
  • URL
    • https://github.com/zaproxy/zaproxy
  • Description
    • The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ...
• Schemathesis
  • Tags
    • testing
    • api
    • documentation
  • URL
    • https://github.com/schemathesis/schemathesis
  • Description
    • Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema.

• Schemathesis
  • Tags
    • testing
    • api
    • documentation
  • URL
    • https://github.com/schemathesis/schemathesis
  • Description
    • Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema.

• cURL
  • Tags
  • URL
    • https://curl.se/
  • Description

• OWASP secureCodeBox
  • Tags
    • vulnerability
    • scanner-orchestration
  • URL
    • https://github.com/secureCodeBox/secureCodeBox
  • Description
    • secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.

• OWASP Code Pulse
  • Tags
  • URL
    • https://www.owasp.org/index.php/OWASP_Code_Pulse
  • Description
• Coverage.py
  • Tags
    • testing
    • coverage
  • URL
    • https://github.com/nedbat/coveragepy
  • Description
    • Code coverage measurement for Python

• nmap
  • Tags
  • URL
    • https://nmap.org/
  • Description
• OWASP Amass
  • Tags
  • URL
    • https://github.com/OWASP/Amass
  • Description

• netassert
  • Tags
  • URL
    • https://github.com/controlplaneio/netassert
  • Description

• kubescape
  • Tags
    • kubernetes
    • vulnerability
    • misconfiguration
  • URL
    • https://github.com/armosec/kubescape
  • Description
    • Testing if Kubernetes is deployed securely as defined in Kubernetes Hardening Guidance by to NSA and CISA
• kube-hunter
  • Tags
  • URL
    • https://github.com/aquasecurity/kube-hunter
  • Description
• openVAS
  • Tags
  • URL
    • https://www.openvas.org/
  • Description

• Example: All docker images used by teams need to be based on standard images.
  • Tags
  • URL
  • Description

• HTC Hydra
  • Tags
    • password
  • URL
    • https://www.htc-cs.com/en/products/htc-hydra/
  • Description

• K8sPurger
  • Tags
    • vulnerability
    • scanner
    • dast
    • infrastructure
  • URL
    • https://github.com/yogeshkk/K8sPurger
  • Description
    • Hunt Unused Resources In Kubernetes.

• OWASP Dependency Check
  • Tags
    • OpenSource
    • Supply Chain
    • vulnerability
  • URL
    • https://owasp.org/www-project-dependency-check/
  • Description
• Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
  • Tags
    • sca
    • inventory
    • OpenSource
    • Supply Chain
    • vulnerability
    • inventory
  • URL
    • https://github.com/DependencyTrack/dependency-track
  • Description
• retire.js
  • Tags
  • URL
    • https://github.com/RetireJS/retire.js/
  • Description
• npm audit
  • Tags
  • URL
    • https://docs.npmjs.com/cli/audit
  • Description
• Dependabot
  • Tags
    • dependency
    • dependency-management
    • scm
  • URL
    • https://github.com/dependabot/dependabot-core
  • Description
    • Dependabot creates pull requests to keep your dependencies secure and up-to-date.

• dependabot
  • Tags
    • auto-pr
    • patching
  • URL
    • https://dependabot.com/
  • Description
• renovate
  • Tags
    • auto-pr
    • patching
  • URL
    • https://github.com/renovatebot/renovate
  • Description

• libyear
  • Tags
    • patching
    • build
  • URL
    • https://libyear.com/
  • Description
    • A simple measure of software dependency freshness. It is a single number telling you how up-to-date your dependencies are.

• Spectral
  • Tags
    • linting
    • api
    • documentation
  • URL
    • https://github.com/stoplightio/spectral
  • Description
    • Spectral is a flexible JSON/YAML linter built with extensibility in mind. It uses JSON/YAML path rules to describe the problems you want to find.
• API OAS Checker
  • Tags
    • linting
    • api
    • documentation
  • URL
    • https://github.com/italia/api-oas-checker
  • Description
    • A tool to check OpenAPI specifications using a comprehensive ruleset based on API best practices.

• Known Exploited Vulnerabilities
  • Tags
    • vulnerability
  • URL
    • https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • Description
    • A catalog of vulnerabilities that have been exploited.
• Exploit Prediction Scoring System
  • Tags
    • vulnerability
  • URL
    • https://www.first.org/epss/
  • Description
    • Estimates the likelihood that a software vulnerability will be exploited.

• Fortify Extension for Visual Studio Code
  • Tags
    • ide
    • sast
  • URL
    • https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code
  • Description
• Setting Up the Visual Studio Code Extension Plugin
  • Tags
    • ide
    • sast
  • URL
    • https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin
  • Description
• HCL AppScan CodeSweep
  • Tags
    • ide
    • sast
  • URL
    • https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep
  • Description
• DevSecOps control Pre-commit
  • Tags
    • pre-commit
  • URL
    • https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop
  • Description
• Building your DevSecOps pipeline 5 essential activities
  • Tags
    • pre-commit
  • URL
    • https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/
  • Description

• retire.js
  • Tags
  • URL
    • https://github.com/RetireJS/retire.js/
  • Description
• npm audit
  • Tags
  • URL
    • https://docs.npmjs.com/cli/audit
  • Description
• Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
  • Tags
    • sca
    • inventory
    • OpenSource
    • Supply Chain
    • vulnerability
    • inventory
  • URL
    • https://github.com/DependencyTrack/dependency-track
  • Description
• Dependabot
  • Tags
    • dependency
    • dependency-management
    • scm
  • URL
    • https://github.com/dependabot/dependabot-core
  • Description
    • Dependabot creates pull requests to keep your dependencies secure and up-to-date.

• eslint
  • Tags
  • URL
    • https://eslint.org/
  • Description
• FindSecurityBugs
  • Tags
  • URL
  • Description
• jsprime
  • Tags
  • URL
    • https://github.com/dpnishant/jsprime
  • Description
• [bdd-mobile-security
  • Tags
  • URL
    • https://github.com/ing-bank/bdd-mobile-security-automation-framework
  • Description
    • bdd-mobile-security-automation-framework
• Fortify Extension for Visual Studio Code
  • Tags
    • ide
    • sast
  • URL
    • https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code
  • Description
• Setting Up the Visual Studio Code Extension Plugin
  • Tags
    • ide
    • sast
  • URL
    • https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin
  • Description
• HCL AppScan CodeSweep
  • Tags
    • ide
    • sast
  • URL
    • https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep
  • Description

• eslint
  • Tags
  • URL
    • https://eslint.org/
  • Description
• FindSecurityBugs
  • Tags
  • URL
  • Description
• jsprime
  • Tags
  • URL
    • https://github.com/dpnishant/jsprime
  • Description
• Fortify Extension for Visual Studio Code
  • Tags
    • ide
    • sast
  • URL
    • https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code
  • Description
• Setting Up the Visual Studio Code Extension Plugin
  • Tags
    • ide
    • sast
  • URL
    • https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin
  • Description
• HCL AppScan CodeSweep
  • Tags
    • ide
    • sast
    • URL
  • https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep
  • Description

• PMD
  • Tags
  • URL
  • Description

• eslint
  • Tags
  • URL
    • https://eslint.org/
  • Description
• FindSecurityBugs
  • Tags
  • URL
  • Description
• jsprime
  • Tags
  • URL
    • https://github.com/dpnishant/jsprime
  • Description
• Fortify Extension for Visual Studio Code
  • Tags
    • ide
    • sast
  • URL
    • https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code
  • Description
• Setting Up the Visual Studio Code Extension Plugin
  • Tags
    • ide
    • sast
  • URL
    • https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin
  • Description
• HCL AppScan CodeSweep
  • Tags
    • ide
    • sast
  • URL
    • https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep
  • Description

• PMD
  • Tags
  • URL
  • Description

• PMD
  • Tags
  • URL
  • Description

• PMD
  • Tags
  • URL
  • Description
• How to enforce a consistent coding style in your projects
  • Tags
    • ide
    • linting
  • URL
    • https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm
  • Description
• In-Depth Linting of Your TypeScript While Coding
  • Tags
    • ide
    • linting
  • URL
    • https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding
  • Description
• Super-Linter
  • Tags
    • linting
    • scm
  • URL
    • https://github.com/github/super-linter
  • Description
    • Lint code bases to catch common errors and enforce code style

• truffleHog
  • Tags
  • URL
    • https://github.com/dxa4481/truffleHog
  • Description
• go-pillage-registries
  • Tags
  • URL
    • https://github.com/nccgroup/go-pillage-registries
  • Description

• kubesec
  • Tags
  • URL
    • https://kubesec.io
  • Description

• ClusterScanner
  • Tags
    • docker
    • image
    • container
    • vulnerability
    • misconfiguration
    • security-tools
    • scanning
  • URL
    • https://github.com/SDA-SE/clusterscanner
  • Description
    • Discover vulnerabilities and container image misconfiguration in production environments.

• Dive to inspect a container images
  • Tags
  • URL
    • https://github.com/wagoodman/dive
  • Description
• ClusterScanner
  • Tags
    • docker
    • image
    • container
    • vulnerability
    • misconfiguration
    • security-tools
    • scanning
  • URL
    • https://github.com/SDA-SE/clusterscanner
  • Description
    • Discover vulnerabilities and container image misconfiguration in production environments.

• kube-bench
  • Tags
  • URL
    • https://github.com/aquasecurity/kube-bench
  • Description

• Dockerfile with hadolint
  • Tags
  • URL
    • https://github.com/hadolint/hadolint
  • Description
• Deployment with kube-score
  • Tags
  • URL
    • https://github.com/zegl/kube-score
  • Description
• dockerfilelint
  • Tags
    • sast
    • docker
    • dockerfile
  • URL
    • https://github.com/replicatedhq/dockerfilelint
  • Description
    • dockerfilelint is an node module that analyzes a Dockerfile and looks for common traps, mistakes and helps enforce best practices.

• SigmaHQ
  • Tags
    • URL
  • https://github.com/SigmaHQ/sigma
  • Description

• ClusterScanner
  • Tags
    • docker
    • image
    • container
    • vulnerability
    • misconfiguration
    • security-tools
    • scanning
  • URL
    • https://github.com/SDA-SE/clusterscanner
  • Description
    • Discover vulnerabilities and container image misconfiguration in production environments.

• Anchore.io
  • Tags
  • URL
    • https://anchore.com/
  • Description
• Clair
  • Tags
  • URL
    • https://github.com/quay/clair
  • Description
• OpenSCAP
  • Tags
  • URL
    • https://www.open-scap.org/
  • Description
• Vuls
  • Tags
  • URL
    • https://github.com/future-architect/vuls
  • Description

• https://github.com/aquasecurity/trivy
  • Tags
  • URL
    • https://github.com/aquasecurity/trivy
  • Description
• Registries like quay
  • Tags
  • URL
  • Description
    • Registries like quay, dockerhub provide (commercial) offerings, often not suitable for distroless images
• Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
  • Tags
    • sca
    • inventory
    • OpenSource
    • Supply Chain
    • vulnerability
    • inventory
  • URL
    • https://github.com/DependencyTrack/dependency-track
  • Description

• Anchore.io
  • Tags
  • URL
    • https://anchore.com/
  • Description
• Clair
  • Tags
  • URL
    • https://github.com/quay/clair
  • Description
• OpenSCAP
  • Tags
  • URL
    • https://www.open-scap.org/
  • Description
• Vuls
  • Tags
  • URL
    • https://github.com/future-architect/vuls
  • Description