〽️ 🥜 🧑🏼‍🤝‍🧑🏼 脅威モデリングからAWSセキュリティまで：DevOpsセキュリティを構築するための50以上のオープンソースツール ✏️ 💃🏼 👨‍👨‍👦‍👦

こんにちは、Habr！私はSwordfishSecurityの情報セキュリティコンサルタントであり、お客様のために安全なDevOpsを構築しています。私は世界のDevSecOpsに向けた企業の発展傾向に従い、最も興味深い慣行をロシア語圏のコミュニティに放送し、顧客の間で私たちのチームとこのプロセスを構築するのを支援しようとしています。過去2年間で、DevSecOpsはますます注目を集めています。新しいツールは、急速に成長している一連のプラクティスの一部になる時間がないため、ツールのリストの形式で何らかのチェックポイントを設定したいと思いました。出発点は記事のリリースでしたMail.ruの同僚。ここでは、Kubernetesのセキュリティに関するセクションが個別に強調表示されています。このリストを拡張して、SDLCライフサイクルの他の段階をカバーし、いくつかの新しいツールを提供することにしました。

実践とは、SDLC / DevOpsのステージの1つに組み込むことができる一連の手段（脅威モデリング、SAST、DAST、SCA、Dockerイメージスキャン、Kubernetesスキャン、AWS監査など）を意味します。

開発者

脅威モデリング

Secure Development Lifecycle . , . , backlog. , , DevSecOps “Shift security to the left”.

IT-, . open-source , .

OWASP Threat Dragon

OWASP Threat Dragon

. , , STRIDE. , , , . GitHub.

Pytm

Pytm

Pytm - Python .

Pytm , . .

Materialize threats tool

Materialize-threats - Python, draw.io , SQL . Gherkin.

open-source , , Enterpise- Irius Risks.

.drawio, data flow
, Rapid Threat Model Prototyping methodology( readme )
.drawio
materialize.py .drawio
Gherkin.

マテリアライズ脅威ツールへの入力としてのdraw.ioのサンプルアーキテクチャ — draw.io Materialize threats tool

マテリアライズ脅威ツールの結果 — Materialize threats tool

open-source :

, , , , :

Awesome threat modeling

(SAST):

, . . Open-source , , , - . :

, .

Salus

Salus

, , Bandit, Gosec, Brakeman, open-source (Ruby,Node.js, Python,Go). :

# Navigate to the root directory of the project you want to run Salus on
$ cd /path/to/repo

# Run the following line while in the root directory (No edits necessary)
$ docker run --rm -t -v $(pwd):/home/repo coinbase/salus

JSON/YAML . GitHub CircleCI.

ShiftLeft Scan

ShiftLeft Scan

Salus, . , docker (gosec, find-sec-bugs, psalm, bandit, …). Docker terraform, bash, kubernetes .

Python :

$ docker run --rm -e "WORKSPACE=${PWD}" -v "$PWD:/app" shiftleft/sast-scan scan --src /app --type python

, IDE.

GitLab SAST

SAST GitLab

Gitlab DevOps , , open-source SAST, . Gitlab SCA, , fuzzing DevSecOps, Gold-.

LGTM

LGTM

LGTM - Semmle, GitHub. Semmle CodeQL , GitHub - Satellite.

Semgrep

Semgrep

, . , , AST Data flow, . , :

$ semgrep --config=&lt;path/to/config> path/to/src

semgrep :

rules:
- id: user-eval
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-either:
    - pattern: eval(..., request.$W.get(...), ...)
    - pattern: |
        $V = request.$W.get(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W(...), ...)
    - pattern: |
        $V = request.$W(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W[...], ...)
    - pattern: |
        $V = request.$W[...]
        ...
        eval(..., $V, ...)

Semgrep , ( , semgrep ):

. , open-source , SAST, . CWE , - . , , CWE CVE.

open-source - SCA

, , open-source, . ( , Equifax). , SCA , , .

Dependency Check

Dependency Check

Dependency Check - open-source OWASP . , , . , Secure SDLC . Dependency Check , , , , Dependency Track.

# Dependency Check Maven Plugin example
$ mvn org.owasp:dependency-check-maven:check

HTML依存関係チェックレポートのスクリーンショット — HTML- Dependency Check

Dependency Track

Dependency Track

Dependency Track - OWASP, -, Software bill of materials (SBOM) CycloneDx. Dependency Track BOM, , , NVD. Slack, Microsoft Teams, .

# CycloneDx Maven Plugin example to make SBOM
$ mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom

Dependency TrackWebインターフェイスのスクリーンショット。 — - Dependency Track.

Snyk Open-source

Snyk Open-source

Snyk , open-source , SaaS-. (GitHub, Bitbucket), CLI.

Pythonプロジェクト用のSnykオープンソースSaaSプラットフォームのスクリーンショット — SaaS- Snyk open-source Python-

snyk npm:

$ npm install -g snyk
$ snyk auth
$ snyk monitor

Sonatype Open-source

NVD ( ) Sonatype OSS, Sonatype, Nexus IQ. , , Nexus IQ SCA . Sonatype OSS - , Dependency Check Dependency Track. , Sonatype open-source SCA, Sonatype OSS:

Nexus Vulnerability Scanner - Sonatype
AuditJS - JS (NPM, Angular, yarn, bower)
Nancy - Golang
Jake - Conda
Chelsea - Ruby
Cheque - C/C++ (GCC)
Ahab - apt, apk, yum, dnf
Pants - Rust (Cargo)
Sonatype Depshield - GitHub

Nexus VulnerabilityScannerレポートのスクリーンショット — Nexus Vulnerability Scanner

SCA:

SCA OWASP
ClearlyDefined
Renovate - White Source
Dependabot - GitHub open-source GitHub

, open-source , , , . , , . , . , .

git-secrets

git-secrets

$ git secrets --scan /path/to/file

Gitrob

gitrob

$ export GITROB_ACCESS_TOKEN=&lt;TOKEN>
$ gitrob &lt;target>

Gitleaks

gitleaks

$ gitleaks --repo-path=&lt;path to repo>
$ gitleaks --repo=&lt;url of github>

Github-action.

TruffleHog

TruffleHog

$ trufflehog [-h] [--json] [--regex] [--rules RULES]
                  [--entropy DO_ENTROPY] [--since_commit SINCE_COMMIT]
                  [--max_depth MAX_DEPTH]
                  git_url

TruffleHog - , , .

GitGuardian

GitGuardian

SaaS . on-prem . .

. Password Vault (HashiCorp Vault, conjur, …)

(DAST):

Arachni

Arachni

open-source , . Docker-, CLI -. , . CWE-.

Docker:

$ docker run -d \
    -p 222:22 \
    -p 7331:7331 \
    -p 9292:9292 \
    --name arachni \
    arachni/arachni:latest

, REST API 7331 json.

OWASP ZAP

OWASP ZAP

open-source , CI/CD. GUI, CLI docker-. .

# OWASP ZAP as a daemon
docker run -p 8090:8090 -i owasp/zap2docker-stable zap.sh -daemon -port 8090 -host 0.0.0.0
# OWASP ZAP runs for 1  minute and then waits for the passive scanning to complete before reporting the results.
docker run -t owasp/zap2docker-weekly zap-baseline.py -t https://www.example.com

Kubernetes-.

, . , Arachni 10 , ZAP , , , .

w3af

w3af

, (, 2012 (https://xakep.ru/2012/11/09/w3af-pentest/)), docker- CI/CD

, open-source Jenkins AWS, w3af.

docker:

$ git clone https://github.com/andresriancho/w3af.git
$ cd w3af/extras/docker/scripts/
$ sudo ./w3af_console_docker

w3af. : https://xakep.ru/2012/11/09/w3af-pentest/

. -. .

, open-source enterprise, . DAST .

Behaviour Driven Development

Behavioral Driven Development (BDD) ( “ ”)- , Test Driven Development (TDD) (“ ”). , , , , . BDD - Gherkin.

, .

Gauntlt

Guantlt - , Behavioral Driven Development. Arachni, nmap, sslyze, sqlmap Gherkin.

# nmap-simple.attack
Feature: simple nmap attack to check for open ports

  Background:
    Given "nmap" is installed
    And the following profile:
      | name     | value       |
      | hostname | example.com |

  Scenario: Check standard web ports
    When I launch an "nmap" attack with:
      """
      nmap -F <hostname>
      """
    Then the output should match /80.tcp\s+open/
    Then the output should not match:
      """
      25\/tcp\s+open
      """

, Guantlt “” , .

. Guantlt BDD-Security, OWASP ZAP, Tenable Nessus Scanner.

Docker:

, Docker ( Docker DevOps), Docker- .

, , .

Clair

Clair

CVE . UI , Klar.

$ docker run -d -e POSTGRES_PASSWORD="" -p 5432:5432 postgres:9.6
$ docker run --net=host -d -p 6060-6061:6060-6061 -v $PWD/clair_config:/config quay.io/coreos/clair:latest -config=/config/config.yaml

Klar

Klar

API Clair.

$ mkdir klar &amp;&amp; cd klar &amp;&amp; wget https://github.com/optiopay/klar/releases/download/v2.4.0/klar-2.4.0-linux-amd64 -O klar &amp;&amp; chmod +x klar
$ CLAIR_ADDR=http: //localhost:6060 CLAIR_THRESHOLD=10 ./klar &lt;docker image>

Trivy

Trivy ( Alpine, RedHat (EL), CentOS, Debian GNU, Ubuntu) (Gemfile.lock, Pipfile.lock, composer.lock, package-lock.json, yarn.lock, Cargo.lock) Clair , , .tar Docker .

# Download bin
$ wget https: //github.com/knqyf263/trivy/releases/download/v0.1.3/trivy_0.1.3_Linux-64bit.deb
$ dpkg -i ./trivy_0. 1 .3_Linux-64bit.deb
# Scan image
$ trivy bkimminich/juice-shop
# Scan image in tar
$ trivy -i ./ my_saved_docker_image.tar

Anchore

Anchore

Docker. REST API CLI.

$ anchore-cli --u admin --p foobar image add httpd:latest
$ anchore-cli --u admin --p foobar image vuln httpd:latest all

Anchore. : https://swordfishsecurity.ru/blog/obzor-utilit-bezopasnosti-docker

AquaMicroscanner

Aqua Security, Trivy.

$ docker run --rm -it aquasec/microscanner --register &lt;email address>

ADD https://get.aquasec.com/microscanner /
RUN chmod +x /microscanner
RUN /microscanner &lt;TOKEN> [--continue-on-failure]

. CVE :

Dagda

Dagda , Dependency Check, Retire.js ClamAV .

$ export DAGDA_HOST='127.0.0.1'
$ export DAGDA_PORT=5000
$ python3 dagda.py vuln --init
$ python3 dagda.py check --docker_image jboss/wildfly

Docker bench

Docker Bench

Docker bench - compliance- , .

CIS Benchmarks Docker.

$ docker run -it --net host --pid host --userns host --cap-add audit_control \
      -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
      -v /etc:/etc:ro \
      -v /usr/bin/containerd:/usr/bin/containerd:ro \
      -v /usr/bin/runc:/usr/bin/runc:ro \
      -v /usr/lib/systemd:/usr/lib/systemd:ro \
      -v /var/lib:/var/lib:ro \
      -v /var/run/docker.sock:/var/run/docker.sock:ro \
      --label docker_bench_security \
      docker/docker-bench-security

Dockle

Dockle

compliance-, , CIS.

$ docker run --rm goodwithtech/dockle:v${DOCKLE_LATEST} [YOUR_IMAGE_NAME]

Ops:

Kubernetes Security

Deploy. Kubernetes, Docker, Kubernetes , Kubernetes .

My Arsenal of Cloud Native (Security) Tools by MARCO LANCINI

Kube-bench

Kube-bench

( ) Aqua Security. CIS Kubernetes Benchmark Kubernetes ( GKE, EKS and AKS)

# Run inside a container
$ docker run --rm --pid=host                      \
   -v $(which kubectl):/usr/bin/kubectl         \
   -t aquasec/kube-bench:latest <master|node>

# Run in a cluster - on master node
$ kubectl run                                          \
      --rm                                             \
      -it                                              \
      kube-bench-master                                \
      --image=aquasec/kube-bench:latest                \
      --restart=Never                                  \
      --overrides="{ \"apiVersion\": \"v1\",           \
          \"spec\": { \"hostPID\": true,               \
          \"nodeSelector\":                            \
          { \"kubernetes.io/role\": \"master\" },      \
          \"tolerations\": [ {                         \
          \"key\": \"node-role.kubernetes.io/master\", \
          \"operator\": \"Exists\",                    \
          \"effect\": \"NoSchedule\" }]}}"             \
      -- master                                        \
      --version 1.8

# Run in a cluster - on worker nodes
$ kubectl run                                \
      --rm                                   \
      -it                                    \
      kube-bench-node                        \
      --image=aquasec/kube-bench:latest      \
      --restart=Never                        \
      --overrides="{ \"apiVersion\": \"v1\", \
          \"spec\": { \"hostPID\": true } }" \
      -- node                                \
      --version 1.8

Kubernetes Auto Analyzer

Kubernetes Auto Analyzer

, Kube-bench, . Kube-bench Aqua Security.

# Put the config file in a directory and mount it to the /data folder
$ docker run --rm                               \
      -v /data:/data raesene/kube_auto_analyzer \
      -c /data/admin.conf -r testdock

# Provide a KUBECONFIG file to identify and authenticate the session
$ kubeautoanalyzer -c <kubeconfig_file_name> -r <report_name> --html

Kube-hunter

Kube-hunter

Kubernetes. , IP- / Kubernetes.

# Run from docker
$ docker run -it --rm --network host aquasec/kube-hunter

# Run from kubectl
$ kubectl run --rm -it                        \
     kube-hunter                            \
     --image=aquasec/kube-hunter            \
     --restart=Never                        \
     --overrides="{ \"apiVersion\": \"v1\", \
     \"spec\": { \"hostNetwork\": true } }"

KubiScan

KubiScan

RBAC- Kubernetes.

, CyberARK.

# Run from MASTER node
$ docker run -it --rm -e CONF_PATH=~/.kube/config -v /:/tmp cyberark/kubiscan [CMD]

# Search for pods with privileged accounts
$ kubiscan -rp

# Show all risky subjects (users, service accounts, groups)
$ kubiscan -rs

# Show all the rules a service account has
$ kubiscan -aars "SANAME" -ns "default" -k "ServiceAccount"

# List service account RoleBindings
$ kubiscan -aarbs "SANAME" -ns "default" -k "ServiceAccount"

Krane

Krane

, RBAC RBAC RedisGraph. RBAC . Krane CLI, docker- , CI/CD.

Statboard

Starboard

, Kubernetes CustomResourceDefinitions (CRDs) trivy, kube-bench, kube-hunter. Starboard kubectl- Octant, Kubernetes.

$ starboard find vulnerabilities deployment/nginx --namespace dev
$ starboard get vulnerabilities deployment/nginx \
  --namespace dev \
  --output yaml

Kubeaudit

Kubeaudit

, Kubernetes.

# Run from kubectl (as plugin)
$ kubectl audit all

Kubesec

Kubesec

Kubernetes .

$ krew install kubesec-scan
$ kubectl kubesec-scan pod <podname>

Deepfence Runtime Threat Mapper

Deepfence Runtime Threat Mapper

community- . , , CI/CD , Registry. SIEM, Slack, Jira, Amazon S3 ( ).

Sysdig Falco

Sysdig Falco

run-time Sysdig, .

Vulnerability Management

SAST, DAST, SCA, Docker Kubernetes, . Vulnerability Management . , API - -. AppSec.Hub, , DevSecOps- CI/CD . open-source .

DefectDojo

DefectDojo

OWASP. (22+) open-source (ZAP, Trivy, nmap, Dependency Check), enterprise (Veracode, Checkmarx, Twistlock). , API.

Secure code Box

Secure code box

Open-source , (ZAP, NMAP, Nikto, Arachni), docker-compose Kibana Elasticsearch. DefectDojo, , ( issue ). UI. -.

, , one-button-click-solution .

Archery

Archery

open-source . Acuntetix, Nessus, Burp, Netsparker, WebInspect. DefectDojo, , ZAP, Burp OpenVAS. , false positive. CI/CD.

vulnerability management:

Public Cloud Security

DevOps (AWS, GCP, Azure, Oracle) on-prem .

, . , , .

AWS. :https://cloudseclist.com/issues/issue-42/

AWS-inventor

AWS-inventor

AWS AWS.

$ python aws_inventory.py
# Select the generated JSON file when prompted
$ firefox gui/dist/index.html

Aws-public-ips

AWS-puclic-ips

AWS ip-.

# Uses default ~/.aws/credentials
$ aws_public_ips -f json -s apigateway,cloudfront,ec2, \
    elasticsearch,elb,elbv2,lightsail,rds,redshift
# With a custom profile
$ AWS_PROFILE=production aws_public_ips ...

CloudSploit

CloudSploit

compliance- AWS, GCP, Azure, OCI. , CIS PCI DSS.

# Edit the&nbsp;index.js&nbsp;file with your AWS key and secret
# Run a standard scan
$ node index.js
# Run a compliance scan
$ node index.js --compliance=hipaa

AWS Security Benchmark

AWS Security Benchmark

AWS CIS Amazon Web Services Foundations Benchmark 1.1.

$ python aws-cis-foundation-benchmark-checklist.py

S3 Scan

S3 Scan

, S3- .

$ python s3scan.py [-f &lt;format>] [-p &lt;profile>]

. , AWS Security:

My-arsenal-of-aws-security-tools

G-Scout

G-Scout

, GCP.

# Permissions required on the projects: Viewer, Security Reviewer, Stackdriver Account Viewer
$ python gscout.py --project-id <projectID>

ScoutSuite

ScoutSuite

GCP, AWS, Oracle, Azure.

# GCP example
# Using an user account
$ python Scout.py --provider gcp --user-account --project-id <projectID>
# Using a service account
$ python Scout.py --provider gcp                                     \
                  --service-account --key-file service_account.json  \
                  --project-id <projectID>

?

, , DevOps/SDLC. , . , IaC. , . BSIMM OWASP SAMM.

, .

RASP - , , ( , , .). Container Run-time Security ( Sysdig Falco). RASP -:

OpenRASP

IAST - , SAST DAST:

Contrast

Fuzzing - , , :

Awesome Fuzzing

IaC Security - :

Cfn Nag - AWS CloudFormation
Checkov - Terraform, AWS CloudFormation Kubernetes
Terrascan - Terraform
Tfsec - Terraform AWS, Azure GCP.
Kubernetes YAML validating:

Compliance-as-code - :

Security Chaos Engineering - , : "" , , , "" . , . - , . Security Chaos Engineering Chaos Engineering , . , , Security Groups, , , VPC, "" . , . :

DevSecOps :

DevSecOps Wine - DevSecOps
DevSecOps Wine Chat -
CloudSec Wine - Public Cloud Security
Mobile AppSec World -
DevSecOps

UPD.

, Awesome DevSecOps , :

Awesome DevSecOps

脅威モデリングからAWSセキュリティまで：DevOpsセキュリティを構築するための50以上のオープンソースツール

目次

開発者

脅威モデリング

OWASP Threat Dragon

Pytm

Materialize threats tool

(SAST):

Salus

ShiftLeft Scan

GitLab SAST

LGTM

Semgrep

open-source - SCA

Dependency Check

Dependency Track

Snyk Open-source

Sonatype Open-source

git-secrets

Gitrob

Gitleaks

TruffleHog

GitGuardian

(DAST):

Arachni

OWASP ZAP

w3af

Behaviour Driven Development

Gauntlt

Docker:

Clair

Klar

Trivy

Anchore

AquaMicroscanner

Dagda

Docker bench

Dockle

Ops:

Kubernetes Security

Kube-bench

Kubernetes Auto Analyzer

Kube-hunter

KubiScan

Krane

Statboard

Kubeaudit

Kubesec

Deepfence Runtime Threat Mapper

Sysdig Falco

Vulnerability Management

DefectDojo

Secure code Box

Archery

Public Cloud Security

AWS-inventor

Aws-public-ips

CloudSploit

AWS Security Benchmark

S3 Scan

G-Scout

ScoutSuite

?

More articles: