Ultimate DevSecOps library 21/09/2023, 08:02

Ultimate DevSecOps library

SEC
DEPLOY
GOOF

OPERATE
AS
DEV LE
RE OPS
BU
ILD

T
TES MONITOR

DevSecOps library info:

STARS 4.8K WATCHERS 148 FORKS 848

This library contains list of tools and methodologies accompanied with resources. The main goal
is to provide to the engineers a guide through opensource DevSecOps tooling. This repository
covers only cyber security in the cloud and the DevSecOps scope.

Table of Contents
Definition
Tooling
Precommit and threat modeling
SAST
DAST

[Link] Page 1 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Orchestration
Supply chain and dependencies
Infrastructure as code
Containers security
Kubernetes
Cloud
Chaos engineering
Policy as code
Methodologies
Other
License

What is DevSecOps
DevSecOps focuses on security automation, testing and enforcement during DevOps - Release
- SDLC cycles. The whole meaning behind this methodology is connecting together
Development, Security and Operations. DevSecOps is methodology providing different
methods, techniques and processes backed mainly with tooling focusing on developer / security
experience.

DevSecOps takes care that security is part of every stage of DevOps loop - Plan, Code, Build,
Test, Release, Deploy, Operate, Monitor.

Various definitions:

[Link]
[Link]
[Link]
[Link]
[Link]

Tooling

Pre-commit time tools

[Link] Page 2 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

In this section you can find lifecycle helpers, precommit hook tools and threat modeling tools.
Threat modeling tools are specific category by themselves allowing you to simulate and discover
potential gaps before you start to develop the software or during the process.

Modern DevSecOps tools allow using Threat modeling as code or generation of threat models
based on the existing code annotations.

Name URL Description Meta

AWS labs tool

preventing you
git-secrets [Link] from committing STARS 12K

secrets to a git
repository

Searchers
git-hound [Link] STARS 1K

secrets in git

Security
Development
goSDL [Link] STARS 510

Lifecycle
checklist

Threat modeling
ThreatPlaybook [Link] STARS 256

as code

OWASP Threat
Threat Dragon [Link] STARS 625

modeling tool

Threat modeling
threatspec [Link] STARS 282

as code

A Pythonic
pytm [Link] framework for STARS 758

threat modeling

A Go framework
Threagile [Link] for threat STARS 493

modeling

A language to
create cyber

[Link] Page 3 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

MAL-lang [Link] threat modeling STARS 22

systems for
specific domains

Microsoft [Link]
Microsoft threat
Threat us/azure/security/develop/threat- STARS 154

modeling tool
modeling tool modeling-tool

A tool to detect
and prevent
Talisman [Link] secrets from STARS 1.8K

getting checked
in

The SEDATED®
Project
(Sensitive
Enterprise Data
Analyzer To
Eliminate
Disclosure)
SEDATED [Link] focuses on STARS 109

preventing
sensitive data
such as user
credentials and
tokens from
being pushed to
Git.

[Link] Sonar linting

Sonarlint STARS 210

core utility for IDE

DevSkim is a
framework of IDE
extensions and
DevSkim [Link] language STARS 821

analyzers that
provide inline
security analysis

[Link] Page 4 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Detects secrets
detect-secrets [Link] STARS 3.2K

in your codebase

A Pluggable
tflint [Link] STARS 4.2K

Terraform Linter

Use SQL to
detect secrets
Steampipe [Link]
from source stars 14

Code Plugin plugin-code

code and data
sources.

Secrets management
Secrets management includes managing, versioning, encryption, discovery, rotating,
provisioning of passwords, certificates, configuration values and other types of secrets.

Name URL Description Meta

Gitleaks is a scanning
GitLeaks [Link] tool for detecting STARS 14K

hardcoded secrets

GitGuardian shield
(ggshield) is a CLI
application that runs
in your local
environment or in a CI
ggshield [Link] STARS 1.4K

environment and
helps you detect
more than 350+
types of secrets and
sensitive files.

TruffleHog is a
scanning tool for
TruffleHog [Link] STARS 12K

detecting hardcoded
secrets

Hashicorp Hashicorp Vault

[Link] Page 5 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Vault [Link] secrets management STARS 28K

Mozilla Mozilla Secrets

[Link] STARS 14K

SOPS Operations

AWS
secrets [Link] AWS secrets manager
STARS 60

manager secrets-manager-actions docs

GH action

Gitrob is a tool to help

find potentially
GitRob [Link] sensitive files pushed STARS 5.7K

to public repositories
on Github

A tool to hunt for

git-wild-
[Link] credentials in the STARS 284

hunt
GitHub

AWS Vault is a tool to

securely store and
access AWS
aws-vault [Link] STARS 7.8K

credentials in a
development
environment

Knox is a service for

storing and rotation
Knox [Link] of secrets, keys, and STARS 1.2K

passwords used by
other services

allows you to encrypt

Chef vault [Link] STARS 409

a Chef Data Bag Item

Encryption/decryption
Ansible
Ansible vault docs utility for Ansible data STARS 317

vault
files

[Link] Page 6 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

OSS and Dependency management

Dependency security testing and analysis is very important part of discovering supply chain
attacks. SBOM creation and following dependency scanning (Software composition analysis) is
critical part of continuous integration (CI). Data series and data trends tracking should be part of
CI tooling. You need to know what you produce and what you consume in context of libraries
and packages.

Name URL Description

CycloneDX
CycloneDX [Link] format for
SBOM

Generates
CycloneDX
SBOM,
supports
cdxgen [Link]
many
languages and
package
managers.

SPDX format
for SBOM -
SPDX [Link] Software
Package Data
Exchange

Snyk scans
and monitors
Snyk [Link] your projects
for security
vulnerabilities

Security
vulncost [Link] Scanner for
VS Code

Dependency-

[Link] Page 7 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

related
attacks
detection and
prevention
Dependency
[Link] through
Combobulator
heuristics and
insight engine
(support
multiple
dependency
schemes)

Dependency
[Link] security
DependencyTrack
track tracking
platform

Simple
dependency
DependencyCheck [Link] security
scanner good
for CI

Helps
developers to
detect the use
[Link] [Link] of JS-library
versions with
known
vulnerabilities

Check
PHP security [Link] vulnerabilities
checker checker in PHP
dependencies

Patch-level
bundler-audit [Link] verification for
bundler

[Link] Page 8 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Dependency
[Link] Scanning
gemnasium
products/analyzers/gemnasium Analyzer
based on
Gemnasium

Automated
dependency
updates built
Dependabot [Link]
into GitHub
providing
security alerts

Automated
dependency
updates,
Renovatebot [Link] patches multi-
platform and
multi-
language

Check for
outdated,
npm-check [Link] incorrect, and
unused
dependencies.

Checks for
several
security
health metrics
on open
source
libraries and
Security
[Link] provides a
Scorecards score (0-10)
to be
considered in
the decision
making of

[Link] Page 9 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

what libraries
to use.

CLI tool and

library for
generating an
Syft [Link] SBOM from
container
images (and
filesystems).

Supply chain specific tools

Supply chain is often the target of attacks. Which libraries you use can have a massive impact
on security of the final product (artifacts). CI (continuous integration) must be monitored inside
the tasks and jobs in pipeline steps. Integrity checks must be stored out of the system and in
ideal case several validation runs with comparison of integrity hashes / or attestation must be
performed.

Name URL Description Meta

Kubernetes Custom Resource

Tekton Definition (CRD) controller that
[Link] STARS 222

chains allows you to manage your supply

chain security in Tekton.

An in-toto attestation is
in- [Link]
authenticated metadata about STARS 149

toto toto/attestation/tree/v0.1.0/spec
one or more software artifacts

Supply-chain Levels for Software

SLSA Official GitHub link STARS 1.3K

Artifacts

Solution for securing your

kritis [Link] software supply chain for STARS 674

Kubernetes apps

ratify [Link] Artifact Ratification Framework STARS 140

[Link] Page 10 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

SAST

Static code review tools working with source code and looking for known patterns and
relationships of methods, variables, classes and libraries. SAST works with the raw code and
usually not with build packages.

Name URL Description Meta

Brakeman is a
static analysis
tool which
checks Ruby
Brakeman [Link] STARS 6.7K

on Rails
applications
for security
vulnerabilities

Hi-Quality
Open source,
Semgrep [Link] STARS 8.8K

works on 17+
languages

Python
Bandit [Link] specific SAST STARS 5.5K

tool

Generic SAST
for Security
Engineers.
Powered by
regex based
libsast [Link] STARS 106

pattern
matcher and
semantic
aware
semgrep

Find and fix

problems in
ESLint [Link] your

[Link] Page 11 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

JavaScript
code

NodeJs SAST
nodejsscan [Link] scanner with STARS 2.2K

GUI

The
SpotBugs
plugin for
FindSecurityBugs [Link] security STARS 2.1K

audits of Java
web
applications

Detect
security
issues in
code review
SonarQube
[Link] with Static STARS 8.1K

community
Application
Security
Testing
(SAST)

Inspects
source code
for security
gosec [Link] STARS 7.1K

problems by
scanning the
Go AST.

Checks
Python
dependencies
Safety [Link] for known STARS 1.5K

security
vulnerabilities
.

[Link] Page 12 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Note: Semgrep is free CLI tool, however some rulesets ([Link] are having
various licences, some can be free to use and can be commercial.

OWASP curated list of SAST tools : [Link]

community/Source_Code_Analysis_Tools

DAST

Dynamic application security testing (DAST) is a type of application testing (in most cases web)
that checks your application from the outside by active communication and analysis of the
responses based on injected inputs. DAST tools rely on inputs and outputs to operate. A DAST
tool uses these to check for security problems while the software is actually running and is
actively deployed on the server (or serverless function).

Name URL Description Meta

Zap proxy providing

various docker
Zap proxy [Link] STARS 11K

containers for CI/CD

pipeline

Light pipeline ready

Wapiti [Link] STARS 767

scanning tool

Template based
Nuclei [Link] security scanning STARS 15K

tool

[Link] CLI DAST tool

purpleteam STARS 104

labs/purpleteam incubator project

OSS-Fuzz:
Continuous Fuzzing
oss-fuzz [Link] STARS 9K

for Open Source

Software

Nikto web server

nikto [Link] STARS 7.1K

scanner

Skipfish is an active
web application

[Link] Page 13 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

skipfish [Link] security STARS 615

reconnaissance tool

Continuous deployment security

Name URL Description Meta

Toolchain for
continuous
scanning of
SecureCodeBox [Link] STARS

applications
and
infrastructure

Open Source
Security
OpenSCAP [Link] STARS

Compliance
Solution

ThreatMapper
hunts for
vulnerabilities
in your
production
platforms,
ThreatMapper [Link] STARS

and ranks
these
vulnerabilities
based on
their risk-of-
exploit.

Kubernetes

Name URL Description Meta

A tool for

[Link] Page 14 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

scanning
KubiScan [Link] Kubernetes STARS 1.2K

cluster for
risky
permissions

Audit
Kubernetes
clusters for
Kubeaudit [Link] various STARS 1.7K

different
security
concerns

The first open-

source tool for
testing if
Kubernetes is
Kubescape [Link] deployed STARS 8.9K

according to
the NSA-CISA
and the MITRE
ATT&CK®.

Security risk
analysis for
kubesec [Link] STARS 1K

Kubernetes
resources

Kubernetes
kube-bench [Link] benchmarking STARS 6.1K

tool

Static code
analysis of
your
kube-score [Link] STARS 2.4K

Kubernetes
object
definitions

[Link] Page 15 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

kube- Active scanner

[Link] STARS 4.4K

hunter for k8s

(purple)

Calico is an
open source
networking
Calico [Link] and network STARS 5K

security
solution for
containers

Simple
Kubernetes
Krane [Link] STARS 618

RBAC static
analysis tool

Starboard
inegrates
security tools
Starboard [Link] STARS 1.3K

by outputs into
Kubernetes
CRDs

Open policy
[Link] agent
Gatekeeper STARS 3.2K

agent/gatekeeper gatekeeper for

k8s

Collection of
tools (or
Inspektor-
[Link] gadgets) to STARS 1.6K

gadget
debug and
inspect k8s

Static analysis
kube-linter [Link] STARS 2.4K

for Kubernetes

A simple-yet-
powerful API
traffic viewer

[Link] Page 16 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

for Kubernetes
enabling you to
mizu-api- view all API
traffic- [Link] communication stars 9.6k

viewer between
microservices
to help your
debug and
troubleshoot
regressions.

The Helm
plugin for Snyk
provides a
HelmSnyk [Link] stars 40

subcommand
for testing the
images.

Policy as code
Kubewarden [Link] for kubernetes stars 61

from SUSE.

Kubernetes- Kubernetes
[Link] stars 257

sigs BOM BOM generator

A multi-
tenancy and
Capsule [Link] policy-based stars 1.3k

framework for
Kubernetes

Badrobot is a
Kubernetes
Badrobot [Link] stars 207

Operator audit
tool

k8s cluster risk

kube-scan [Link] assessment STARS 770

tool

Istio is a

[Link] Page 17 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

service mesh
based on
Envoy. Engage
encryption,
Istio [Link] stars 34k

role-based
access, and
authentication
across
services.

Visualize
Kubernetes
inventory and
Kubernetes [Link]
permissions stars 21

Insights kubernetes-insights
through
relationship
graphs.

Check
compliance of
Kubernetes [Link] Kubernetes
stars 28

Compliance kubernetes-compliance configurations

to security
best practices.

Containers

Name URL Description Meta

Trusted cloud
Harbor [Link] native registry STARS 21K

project

Centralized
service for
inspection,
Anchore [Link] analysis, and STARS 1.6K

certification of
container

[Link] Page 18 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

images

Docker
Clair [Link] vulnerability STARS 21K

scanner

Apache v2,
powerful
runtime
Deepfence vulnerability
[Link] STARS 4.4K

ThreatMapper scanner for

kubernetes,
virtual machines
and serverless.

Docker
[Link]
Docker bench benchmarking STARS 21K

security
against CIS

Container
Falco [Link] runtime STARS 6.3K

protection

Comprehensive
scanner for
Trivy [Link] vulnerabilities in STARS 19K

container
images

Notary [Link] Docker signing STARS 3.1K

Container
Cosign [Link] STARS 3.6K

signing

Updates the
running version
watchtower [Link] of your STARS 15K

containerized
app

Vulnerability
scanner for

[Link] Page 19 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

container
Grype [Link] STARS 6.5K

images (and
also
filesystems).

Multi-Cloud

Name URL Description Meta

Detection of
security risks in
Cloudsploit [Link] STARS 2.9K

cloud
infrastructure

NCCgroup
ScoutSuite [Link] mutlicloud STARS 5.6K

scanning tool

Multicloud
[Link] security
CloudCustodian STARS 4.9K

custodian/ analysis
framework

GraphQL API +
Security for
CloudGraph [Link] STARS 849

AWS, Azure,
GCP, and K8s

Instantly query
your cloud,
code, logs &
more with SQL.
Build on
Steampipe [Link] thousands of stars 5.6k

open-source
benchmarks &
dashboards for
security &
insights.

[Link] Page 20 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

AWS

AWS specific DevSecOps tooling. Tools here cover different areas like inventory management,
misconfiguration scanning or IAM roles and policies review.

Name URL Description Meta

Dragoneye
Dragoneye [Link] Indeni AWS STARS REPO NOT FOUND

scanner

Prowler is a
command line
tool that helps
with AWS
security
Prowler [Link] STARS 8.6K

assessment,
auditing,
hardening and
incident
response.

Helps to
discover all
aws-inventory [Link] AWS resources STARS 682

created in an
account

Policy as Code
PacBot [Link] STARS 1.2K

Bot (PacBot)

Monitoring
dashboard for
Komiser [Link] STARS 3.5K

costs and
security

IAM analysis
Cloudsplaining [Link] STARS 1.8K

framework

Continuously
monitor your

[Link] Page 21 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

ElectricEye [Link] AWS services STARS 796

for
configurations

CloudMapper
helps you
analyze your
Cloudmapper [Link] STARS 5.7K

Amazon Web
Services (AWS)
environments

Consolidates
AWS
infrastructure
assets and the
cartography [Link] STARS 2.7K

relationships
between them
in an intuitive
graph

IAM Least
policy_sentry [Link] Privilege Policy STARS 1.9K

Generator

IAM Least
Privilege
AirIAM [Link] STARS 732

anmalyzer and
Terraformer

AirBnB
serverless, real-
time data
analysis
framework
StreamAlert [Link] STARS 2.8K

which
empowers you
to ingest,
analyze, and
alert

[Link] Page 22 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

AirBnB
serverless, real-
time data
analysis
CloudQuery [Link] framework STARS 5.1K

which
empowers you
to ingest,
analyze, and
alert

A tool to find
open S3
S3Scanner [Link] buckets and STARS 2.2K

dump their
contents

A tool to use
AWS IAM
aws-iam- [Link] credentials to
STARS 2K

authenticator iam-authenticator/ authenticate to

a Kubernetes
cluster

A tool to use
AWS IAM
credentials to
kube2iam [Link] STARS 1.9K

authenticate to
a Kubernetes
cluster

AWS open Collection of

source official AWS
Official AWS opensource repo AMAZON AWS

security open-source
samples resources

Deploy, update,
and stage your
AWS Firewall WAFs while
Globaldatanet FMS automation STARS 155

factory managing them

[Link] Page 23 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

centrally via
FMS

Parliament is an
Parliment Parliment AWS IAM linting STARS 954

library

Adds
informative and
consistent tags
across
infrastructure-
Yor Yor as-code STARS 705

frameworks
such as
Terraform,
CloudFormation,
and Serverless

Visualize AWS
inventory and
[Link] permissions
AWS Insights stars 76

aws-insights through
relationship
graphs.

Check
compliance of
AWS [Link] AWS
stars 317

Compliance aws-compliance configurations

to security best
practices.

Google cloud platform

GCP specific DevSecOps tooling. Tools here cover different areas like inventory management,
misconfiguration scanning or IAM roles and policies review.

Name URL Description Meta

[Link] Page 24 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Complex security
[Link]
Forseti orchestration and STARS 1.3K

security/forseti-security
scanning platform

Visualize GCP inventory

GCP [Link]
and permissions through stars 7
Insights mod-gcp-insights
relationship graphs.

Check compliance of GCP

GCP [Link]
configurations to security stars 29

Compliance mod-gcp-compliance
best practices.

Microsoft Azure

Azure specific DevSecOps tooling. Tools here cover different areas like inventory management,
misconfiguration scanning or IAM roles and policies review.

Name URL Description Meta

Visualize Azure inventory

Azure [Link]
and permissions through stars 8

Insights mod-azure-insights
relationship graphs.

Check compliance of
Azure [Link]
Azure configurations to stars 46

Compliance mod-azure-compliance
security best practices.

Policy as code
Policy as code is the idea of writing code in a high-level language to manage and automate
policies. By representing policies as code in text files, proven software development best
practices can be adopted such as version control, automated testing, and automated
deployment. (Source: [Link]

Name URL Description Meta

General-purpose policy
Open engine that enables unified,
Policy [Link] context-aware policy STARS 8.5K

[Link] Page 25 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

agent agent/opa enforcement across the

entire stack

Kyverno is a policy engine

Kyverno [Link] STARS 4.4K

designed for Kubernetes

Chef InSpec is an open-

source testing framework
for infrastructure with a
human- and machine-
Inspec [Link] STARS 2.7K

readable language for

specifying compliance,
security and policy
requirements.

Cloud [Link]
Cloud Formation policy as
Formation cloudformation/cloudformation- STARS 1.2K

code
guard guard

cnspec is a cloud-native
and powerful Policy as
Code engine to assess the
security and compliance of
your business-critical
infrastructure. cnspec finds
vulnerabilities and
misconfigurations on all
systems in your
cnspec [Link] STARS 196

infrastructure including:
public and private cloud
environments, Kubernetes
clusters, containers,
container registries,
servers and endpoints,
SaaS products,
infrastructure as code,
APIs, and more.

[Link] Page 26 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Chaos engineering

Chaos Engineering is the discipline of experimenting on a system in order to build confidence in

the system’s capability to withstand turbulent conditions in production.

Reading and manifestos: [Link]

Name URL Description Meta

It is a cloud-native Chaos
chaos- [Link] Engineering platform that
STARS 5.9K

mesh mesh/chaos-mesh orchestrates chaos on

Kubernetes environments

Chaos Monkey is
responsible for randomly
terminating instances in
Chaos
[Link] production to ensure that STARS 14K

monkey
engineers implement their
services to be resilient to
instance failures.

The Chaos Engine is a tool

that is designed to
intermittently destroy or
degrade application
resources running in cloud
Chaos [Link] based infrastructure.
STARS 66

Engine engine/ These events are designed

to occur while the
appropriate resources are
available to resolve the
issue if the platform fails to
do so on it's own.

Test how your system

chaoskube [Link] behaves under arbitrary STARS 1.7K

pod failures.

Gamified chaos

[Link] Page 27 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Kube- [Link] engineering tool for STARS 917

Invaders sideburn/KubeInvaders Kubernetes

Gamified chaos
kube- [Link]
engineering tool for STARS 2.8K

monkey monkey
Kubernetes

Litmus is an end-to-end
chaos engineering
platform for cloud native
Litmus infrastructure and
[Link] STARS 3.8K

Chaos applications. Litmus is

designed to orchestrate
and analyze chaos in their
environments.

Chaos enginnering SaaS

[Link]
Gremlin platform with free plan and STARS 53

python
some open source libraries

[Link]
AWS FIS AWS Fault injection
samples/aws-fault-injection- STARS 31

samples simulator samples

simulator-samples

CLI tool to delete all

[Link]
CloudNuke resources in an AWS STARS 2.5K

io/cloud-nuke
account

Infrastructure as code security

Scanning your infrastructure when it is only code helps shift-left the security. Many tools offer in
IDE scanning and providing real-time advisory do Cloud engineers.

Name URL Description Meta

Checkmarx security
KICS [Link] testing opensource for STARS 1.7K

IaC

Checkov is a static

[Link] Page 28 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

code analysis tool for

Checkov [Link] STARS 5.9K

infrastructure-as-
code

tfsec uses static

analysis of your
terraform templates to
tfsec [Link] spot potential security STARS 6.3K

issues. Now with

terraform CDK
support

Terrascan is a static
terrascan [Link] code analyzer for STARS 4.2K

Infrastructure as Code

cfsec scans
CloudFormation
cfsec [Link] STARS 59

configuration files for

security issues

Looks for insecure

cfn_nag [Link] patterns in STARS 1.2K

CloudFormation

Scans your repository

Sysdig IaC
[Link] with Sysdig IAC
scanner STARS 4

scanner-action Scanner and report

action
the vulnerabilities.

Check compliance of
Terraform Terraform
[Link]
Compliance configurations to AWS stars 20

mod-terraform-aws-compliance
for AWS security best
practices.

Check compliance of
Terraform Terraform
[Link]
Compliance configurations to stars 5

mod-terraform-azure-compliance
for Azure Azure security best
practices.

[Link] Page 29 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Check compliance of
Terraform Terraform
[Link]
Compliance configurations to GCP stars 2

mod-terraform-gcp-compliance
for GCP security best
practices.

Check compliance of
Terraform Terraform
[Link]
Compliance configurations to OCI stars 2

mod-terraform-oci-compliance
for OCI security best
practices.

Orchestration
Event driven security help to drive, automate and execute tasks for security processes. The
tools here and not dedicated security tools but are helping to automate and orchestrate security
tasks or are part of most modern security automation frameworks or tools.

Name URL Description Meta

Platform for integration

and automation across
StackStorm [Link] services and tools STARS 5.7K

supporting event driven

security

[Link] Workflow and process

Camunda STARS 3.5K

bpm-platform automation

Security orchestration
[Link]
DefectDojo and vulnerability STARS 3K

DefectDojo
management platform

Security suite for

Security Orchestration,
Faraday [Link] vulnerability stars 4.2k

management and
centralized information

[Link] Page 30 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Methodologies, whitepapers and architecture

List of resources worth investigating:

[Link]
ference%20Design%20v1.0_Public%[Link]
[Link]
[Link]
[Link]
[Link]
[Link]

AWS DevOps whitepapers:

[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link] (AWS + SANS whitepaper)

AWS blog:

[Link]
pipeline-with-open-source-sca-sast-and-dast-tools/
[Link]
devsecops-software-factory-on-aws/

Microsoft whitepapers:

[Link] Page 31 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

[Link]
into-your-devops-practices/DevSecOps_Report_Tips_D6_fm.pdf
[Link]
azure
[Link]
github

GCP whitepapers:

[Link]
[Link]
[Link]
[Link]
[Link]

Other
Here are the other links and resources that do not fit in any previous category. They can meet
multiple categories in time or help you in your learning.

Name URL Description Meta

ASH is a one stop shop for

security scanners, and does
not require any installation. It
will identify the different
frameworks, and download
the relevant, up to date tools.
Automated
[Link] ASH is running on isolated
Security
samples/automated-security- Docker containers, keeping STARS 227

Helper
helper the user environment clean,
(ASH)
with a single aggregated
report. The following
frameworks are supported:
Git, Python, Javascript,
Cloudformation, Terraform
and Jupyter Notebooks.

[Link] Page 32 of 33
Ultimate DevSecOps library 21/09/2023, 08:02

Mobile
[Link] SAST, DAST and pentesting
security STARS 15K

Security-Framework-MobSF tool for mobile apps

framework

Detect and remediate

[Link] misconfigurations and
Legitify STARS 639

Labs/legitify security risks across all your

GitHub and GitLab assets

Training - [Link]

DevSecOps videos - Hackitect playground

License
MIT license

Marek Šottl (c) 2022

[Link] Page 33 of 33