Hands-On Security in DevOps Ensure continuous security, deployment, and delivery with DevSecOps

Title Page......Page 2
Copyright and Credits......Page 3
Hands-On Security in DevOps......Page 4
Packt Upsell......Page 5
Why subscribe?......Page 6
PacktPub.com......Page 7
Contributors......Page 8
About the author......Page 9
About the reviewer......Page 10
Packt is searching for authors like you......Page 11
Preface......Page 33
Who this book is for......Page 34
What this book covers......Page 35
To get the most out of this book......Page 39
Download the color images......Page 40
Conventions used......Page 41
Get in touch......Page 42
Reviews......Page 43
DevSecOps Drivers and Challenges......Page 44
Security compliance......Page 46
ISO 27001......Page 47
ISO 27017 and ISO 27018......Page 50
Cloud Security Alliance (CSA)......Page 51
Federal Information Processing Standards (FIPS)......Page 53
Center for Internet Security (CIS) and OpenSCAP – securing your infrastructure......Page 55
National Checklist Program (NCP) repository......Page 58
OpenSCAP tools......Page 59
Legal and security compliance......Page 60
New technology (third-party, cloud, containers, and virtualization)......Page 62
Virtualization......Page 63
Dockers......Page 65
Infrastructure as Code (IaC)......Page 68
Cloud services hacks/abuse......Page 69
Case study – products on sale......Page 70
What do hackers do?......Page 71
Rapid release......Page 72
Summary......Page 74
Questions......Page 75
Further reading......Page 77
Security Goals and Metrics......Page 78
Organization goal......Page 79
Strategy and metrics......Page 81
Policy and compliance......Page 82
Education and guidance......Page 83
Development goal/metrics......Page 84
Threat assessment......Page 85
Threat assessment for GDPR......Page 87
Deliverables and development team self-assessment......Page 88
Security requirements......Page 90
QA goal/metrics......Page 95
Design review......Page 96
Implementation review......Page 97
Third-party components......Page 98
IDE-plugin code review......Page 99
Static code review......Page 100
Target code review......Page 102
Security testing......Page 103
Operation goal/metrics......Page 105
Issue management......Page 106
Environment Hardening......Page 109
Secure configuration baseline......Page 110
Constant monitoring mechanism......Page 111
Operational enablement......Page 113
Code signing for application deployment......Page 114
Application communication ports matrix......Page 115
Application configurations......Page 116
Summary......Page 117
Questions......Page 119
Further reading......Page 120
Security Assurance Program and Organization......Page 121
Security assurance program......Page 122
SDL (Security Development Lifecycle)......Page 123
OWASP SAMM......Page 126
Security guidelines and processes......Page 128
Security growth with business......Page 131
Stage 1 – basic security control ......Page 132
Stage 2 – building a security testing team......Page 133
Stage 3 – SDL activities......Page 135
Stage 4 – self-build security services......Page 136
Stage 5 – big data security analysis and automation......Page 137
Role of a security team in an organization......Page 140
Security office under a CTO......Page 141
Dedicated security team......Page 143
Case study – a matrix, functional, or taskforce structure......Page 145
Security resource pool......Page 146
Security technical committee (taskforce)......Page 147
Summary......Page 149
Questions......Page 150
Further reading......Page 151
Security Requirements and Compliance......Page 153
Security requirements for the release gate......Page 154
Release gate examples......Page 155
Common Vulnerability Scoring System (CVSS)......Page 157
Security requirements for web applications......Page 159
OWASP Application Security Verification Standard (ASVS)......Page 160
Security knowledge portal......Page 162
Security requirements for big data......Page 163
Big data security requirements......Page 164
Big data technical security frameworks......Page 166
Privacy requirements for GDPR......Page 169
Privacy Impact Assessment (PIA)......Page 171
Privacy data attributes......Page 172
Example of a data flow assessment......Page 174
GDPR security requirements for data processor and controller......Page 176
Summary......Page 179
Questions......Page 180
Further reading......Page 181
Case Study - Security Assurance Program......Page 183
Security assurance program case study......Page 184
Microsoft SDL and SAMM......Page 186
Security training and awareness......Page 191
Security culture......Page 193
Web security frameworks......Page 195
Baking security into DevOps......Page 196
Summary......Page 198
Questions......Page 199
Further reading......Page 200
Security Architecture and Design Principles......Page 201
Security architecture design principles......Page 202
Cloud service security architecture reference......Page 205
Security framework......Page 206
Java web security framework......Page 207
Non-Java web security frameworks......Page 209
Web readiness for privacy protection......Page 210
Login protection......Page 213
Cryptographic modules......Page 214
Input validation and sanitization......Page 216
Data masking......Page 219
Data governance – Apache Ranger and Atlas......Page 222
Third-party open source management......Page 224
Summary......Page 227
Questions......Page 228
Further reading......Page 230
Threat Modeling Practices and Secure Design......Page 231
Threat modeling practices......Page 232
Threat modeling with STRIDE......Page 234
Diagram designer tool......Page 238
Card games......Page 239
Threat library references......Page 242
Case study – formal documents or not?......Page 243
Secure design......Page 245
Summary......Page 253
Questions......Page 254
Further reading......Page 255
Secure Coding Best Practices......Page 257
Secure coding industry best practices......Page 258
Establishing secure coding baselines......Page 260
Secure coding awareness training......Page 261
Tool evaluation......Page 262
Tool optimization......Page 267
High-risk module review......Page 269
Manual code review tools......Page 271
Secure code scanning tools......Page 273
Secure compiling......Page 280
Common issues in practice......Page 283
Summary......Page 284
Questions......Page 285
Further reading......Page 287
Case Study - Security and Privacy by Design......Page 288
Case study background......Page 289
Secure architecture review......Page 290
Authentication......Page 293
Authorization......Page 295
Session management......Page 297
Data input/output......Page 299
Privacy by design......Page 301
Summary of security and privacy frameworks ......Page 303
Third-party component management......Page 305
Summary......Page 308
Questions......Page 310
Further reading......Page 311
Security-Testing Plan and Practices......Page 312
Security-testing knowledge kit......Page 313
Security-testing plan templates......Page 315
Security-testing objective......Page 316
Security-testing baseline......Page 317
Security-testing environment......Page 318
Testing strategy......Page 319
High-risk modules......Page 320
Recommended security-testing tools......Page 322
Web security testing......Page 326
Privacy......Page 329
Security-testing domains......Page 332
Thinking like a hacker......Page 334
Exploits and CVE......Page 335
Hacker techniques......Page 336
Malware Information......Page 337
Security-Training environment......Page 338
Summary......Page 339
Questions......Page 340
Further reading......Page 342
Whitebox Testing Tips......Page 343
Whitebox review preparation......Page 344
Viewing the whole project......Page 347
High-risk module......Page 350
Whitebox review checklist......Page 352
Top common issues......Page 354
Secure coding patterns and keywords......Page 357
Case study – Java struts security review......Page 361
Struts security review approaches......Page 362
Struts security checklist......Page 364
Struts security strings search in struts.xml and API......Page 365
Summary......Page 367
Questions......Page 368
Further reading......Page 369
Security Testing Toolkits......Page 370
General security testing toolkits......Page 371
Automation testing criteria......Page 373
Behavior-driven security testing framework......Page 376
Android security testing......Page 379
Securing infrastructure configuration......Page 383
Docker security scanning......Page 385
Integrated security tools......Page 387
Summary......Page 391
Questions......Page 392
Further reading......Page 394
Security Automation with the CI Pipeline......Page 395
Security in continuous integration......Page 396
Security practices in development......Page 397
IDE plugins to automate the code review......Page 398
Static code analysis......Page 400
Secure compiler configuration......Page 402
Dependency check......Page 404
Web testing in proactive/proxy mode......Page 405
Web automation testing tips......Page 407
Security automation in Jenkins......Page 410
 Summary......Page 413
Questions......Page 414
Further reading......Page 415
Incident Response......Page 416
Security incident response process......Page 417
Preparation......Page 419
Detection and analysis......Page 422
Containment and recovery......Page 428
Post-incident activity......Page 430
Security incident response platforms (SIRP)......Page 433
SOC team......Page 434
Incident forensics techniques......Page 436
Summary......Page 439
Questions......Page 440
Further reading......Page 442
Security Monitoring......Page 444
Logging policy......Page 445
Security monitoring framework......Page 448
Source of information ......Page 450
Threat intelligence toolset......Page 453
Security scanning toolset......Page 456
Malware behavior matching – YARA......Page 458
Summary......Page 460
Questions......Page 461
Further reading......Page 463
Security Assessment for New Releases......Page 464
Security review policies for releases......Page 465
Security checklist and tools......Page 468
BDD security framework......Page 473
Consolidated testing results......Page 475
Summary......Page 479
Questions......Page 480
Further reading......Page 481
Threat Inspection and Intelligence......Page 482
Unknown threat detection......Page 483
Indicators of compromises......Page 487
Security analysis using big data frameworks......Page 492
TheHive ......Page 495
MISP – an Open Source Threat Intelligence Platform......Page 496
Apache Metron......Page 498
Summary......Page 500
Questions......Page 501
Further reading......Page 503
Business Fraud and Service Abuses......Page 504
Business fraud and abuses......Page 505
Business risk detection framework......Page 508
PCI DSS compliance......Page 516
Summary......Page 520
Questions......Page 521
Further reading......Page 523
GDPR Compliance Case Study......Page 524
GDPR security requirement......Page 525
Case studies......Page 533
Case 1 – personal data discovery......Page 534
Case 2 – database anonymization......Page 536
Case 3 – cookie consent......Page 539
Case 4 – data-masking library for implementation......Page 541
Case 5 – evaluating website privacy status......Page 542
Summary......Page 543
Questions......Page 544
Further reading......Page 546
DevSecOps - Challenges, Tips, and FAQs......Page 547
DevSecOps for security management ......Page 548
DevSecOps for the development team ......Page 551
DevSecOps for the testing team......Page 554
DevSecOps for the operations team......Page 566
Summary......Page 592
Further reading......Page 594
Assessments......Page 595
Chapter 1......Page 596
Chapter 2......Page 597
Chapter 3......Page 598
Chapter 4......Page 599
Chapter 5......Page 600
Chapter 6......Page 601
Chapter 7......Page 602
Chapter 8......Page 603
Chapter 9......Page 604
Chapter 10......Page 605
Chapter 11......Page 606
Chapter 12......Page 607
Chapter 13......Page 608
Chapter 14......Page 609
Chapter 15......Page 610
Chapter 16......Page 611
Chapter 17......Page 612
Chapter 18......Page 613
Chapter 19......Page 614
Other Books You May Enjoy......Page 615
Leave a review - let other readers know what you think......Page 617