Category: Coding

Thu thập thông tin Các dạng thu thập thông tin. Types of Footprinting:Passive Footprinting: Gathering information about the target without direct interaction ==> chú trọng về lượng, càng nhiều càng tốt.Active Footprinting: Gathering information about the target with direct interaction ==> chú trong về chất, càng có nhiều ý nghĩa càng tốt. Con người: là…

Read More “[DevSecOps] Tìm hiểu về thu thập thông tin.” »

Find and automatically fix vulnerabilities in your code, open source dependencies, containers, and infrastructure as code — all powered by Snyk’s industry-leading security intelligence. Hiện tại bạn có thể sài gói free khá hời, cho mục đích cá nhân. Hiện tại thì Synk integrate với khá nhiều products. Bạn thực hiện add repo trên github…

Read More “[Snyk] Scan your code quickly to prevent attack form Hackers.” »

Falco, the open-source cloud-native runtime security project. Falco detects unexpected application behavior and alerts on threats at runtime. It has complete container visibility through a single sensor that allows us to gain insight into application and container behavior. Falco is based on rules that will trigger alerts when conditions are met, for example Falco is…

Read More “[Falco] Detect and watch all commands in your Kubernetes cluster” »

Building Reusable DevSecOps Pipelines on a Secure Kubernetes… Steven Terrana & Michael Ducy Claranet Cyber Security – Achieving DevSecOps with Open-Source Tools https://www.claranetcybersecurity.com/blog/2019-04-23-achieving-devsecops-open-source-tools Accelera – What the Sec is DevSecOps?

1) CIS Benchmarking Configuration guidelines for various technology groups to safeguard systems against today’s evolving cyber threats The Center for Internet Security (CIS) releases benchmarks for best practice security recommendations. 2) Kube-bench kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. Run…

Read More “[Kubernetes Operations and Security] CIS Benchmarking and Kube-bench – Follow the best practice security recommendations for your Kubernetes.” »

Dynamic Application Security Testing DAST looks for security vulnerabilities by simulating external attacks on an application while the application is running. DAST test is performed in a dynamic environment. SAST scans an application’s code line by line when the application is at rest. (SonarQube)DAST has no access to an application’s source code, it detects security…

Read More “[DAST] OWASP ZAP – Understand about Dynamic Application Security Testing” »

Kubesec is an open-source Kubernetes security scanner and analysis tool. It scans your Kubernetes cluster for common exploitable risks such as privileged capabilities and provides a severity score for each found vulnerability. Security risk analysis for Kubernetes resources.Take in a single YAML file as input. + One YAML can connect multiple Kubernetes resources.Kubesec is available…

Read More “[KubeSec] Security risk analysis for Kubernetes resources” »

https://www.conftest.dev/ The Open Policy Agent (OPA, pronounced “oh-pa”) is an open source, general-purpose policy engine that unifies policy enforcement across the stack. Conftest is a utility to help you write tests (statically analyze) against structured configuration data. Using Conftest you can write tests for, + Terraform code, + Kubernetes Configurations + Dockerfile or any other…

Read More “[OPA Conftest] general-purpose policy engine” »

1) Bacsic Trivy Trivy is a simple and comprehensive vulnerability scanner for containers and other artifacts. When you use –exit-code 0, you are telling Trivy to always return an exit code of 0, regardless of whether vulnerabilities are found or not. This means that even if Trivy detects vulnerabilities that match the specified severity, the…

Read More “[Trivy] Protect your application by Trivy” »