Ultimate DevSecOps library

Contribution rules

If you want to contribute to this library of knowledge please create proper PR (Pull Request) with description what you are adding following these set of rules:

• Clear description of PR (which tool, why, number of stars, maturity and topic)
• Keep it simple - Fill the description properly
• Fact over feelings or personal opinions
• Add source and follow the library style
• Avoid duplicits - one tool, one topic
• Try to make bigger updates then on tool link
• Currently open-source only
• Add only active projects
• Add only security tools
• Report typos as issue not via PR.

Note: Currently this is an early version of the library. I recommend PR after first official release.

DevSecOps library info:

This library contains list of tools and methodologies accompanied with resources. The main goal is to provide to the engineers a guide through opensource DevSecOps tooling. This repository covers only cyber security in the cloud and the DevSecOps scope.

Table of Contents

• Ultimate DevSecOps library
  • Contribution rules
• Table of Contents
• What is DevSecOps
• Tooling
  • Pre-commit time tools
  • Secrets management
  • OSS and Dependency management
  • Supply chain specific tools
  • SAST
  • DAST
  • Continuous deployment security
  • Kubernetes
  • Containers
  • Multi-Cloud
  • AWS
  • Google cloud platform
  • Microsoft Azure
  • Policy as code
  • Chaos engineering
  • Infrastructure as code security
  • Orchestration
  • AI
• Methodologies, whitepapers and architecture
• Other
• License

What is DevSecOps

DevSecOps focuses on security automation, testing and enforcement during DevOps - Release - SDLC cycles. The whole meaning behind this methodology is connecting together Development, Security and Operations. DevSecOps is methodology providing different methods, techniques and processes backed mainly with tooling focusing on developer / security experience.

DevSecOps takes care that security is part of every stage of DevOps loop - Plan, Code, Build, Test, Release, Deploy, Operate, Monitor.

Various definitions:

• https://www.redhat.com/en/topics/devops/what-is-devsecops
• https://www.ibm.com/cloud/learn/devsecops
• https://snyk.io/series/devsecops/
• https://www.synopsys.com/glossary/what-is-devsecops.html
• https://spacelift.io/blog/what-is-devsecops

Tooling

Pre-commit time tools

In this section you can find lifecycle helpers, precommit hook tools and threat modeling tools. Threat modeling tools are specific category by themselves allowing you to simulate and discover potential gaps before you start to develop the software or during the process.

Modern DevSecOps tools allow using Threat modeling as code or generation of threat models based on the existing code annotations.

Name	URL	Description	Meta
git-secrets	https://github.com/awslabs/git-secrets	AWS labs tool preventing you from committing secrets to a git repository
git-hound	https://github.com/tillson/git-hound	Searchers secrets in git
goSDL	https://github.com/slackhq/goSDL	Security Development Lifecycle checklist
ThreatPlaybook	https://github.com/we45/ThreatPlaybook	Threat modeling as code
Threat Dragon	https://github.com/OWASP/threat-dragon	OWASP Threat modeling tool
threatspec	https://github.com/threatspec/threatspec	Threat modeling as code

Secrets management

Secrets management includes managing, versioning, encryption, discovery, rotating, provisioning of passwords, certificates, configuration values and other types of secrets.

Name	URL	Description	Meta
GitLeaks	https://github.com/zricethezav/gitleaks	Gitleaks is a scanning tool for detecting hardcoded secrets
ggshield	https://github.com/gitguardian/ggshield	GitGuardian shield (ggshield) is a CLI application that runs in your local environment or in a CI environment and helps you detect more than 350+ types of secrets and sensitive files.
TruffleHog	https://github.com/trufflesecurity/truffleHog	TruffleHog is a scanning tool for detecting hardcoded secrets
Hashicorp Vault	https://github.com/hashicorp/vault	Hashicorp Vault secrets management
Mozilla SOPS	https://github.com/mozilla/sops	Mozilla Secrets Operations
AWS secrets manager GH action	https://github.com/marketplace/actions/aws-secrets-manager-actions