1copenut/devsecops

I like making things secure. This is my path to making my Ops decisions so.

devsecops's Issues

Stand up an NGINX server with Open Ziti on a cloud instance and connect to it darkly

• https://www.youtube.com/watch?v=nohnD9azwAk&t=1s
• https://blog.openziti.io/nginx-zerotrust-api-security

Read "Keeping your GitHub Actions and workflows secure" Pts I-III

https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

Set up Security Scorecard as a GitHub Action on public repos

Description

Google has released an automated security scanner as a GitHub Action or a CLI tool to check for security vulns. Would make a great thing to add to the C3-Eleventy repo and a few other open-source ones like PAUS.

• https://securityscorecards.dev/

Try out the Security Scorecard scanner

• https://securityscorecards.dev/

Try this preferably on something low risk (that you own) like your personal site build.

Set up CodeQL GHA workflow

https://codeql.github.com/

Tie this together with your Ansible repo

• Use this as the documentation site, and this one below for practical implementation
• https://github.com/1Copenut/ansible-workstation-config

Add a SAST like Bearer CLI

https://github.com/bearer/bearer for code analysis

Read "Security hardening for GitHub Actions"

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

Set up secret scanning

• https://github.com/awslabs/git-secrets (any or all repos via command line)
• https://github.com/trufflesecurity/trufflehog (GHA)

Test Terraform configs for security issues

https://github.com/aquasecurity/tfsec-pr-commenter-action/tree/main

[META] Zero Trust super issue

Description

Zero Trust is quite the subject. I've been reading up a lot lately and think it'd be a fine way to have servers on the cloud...somewhere...without exposing them to the broader internet. This meta issue will capture small projects I want to accomplish much the way my react-bytes project has for learning React concepts.

Tasks

• #11

Explore the techniques from "Hack this repository: The EkoParty 2020 GitHub CTF challenges"

https://securitylab.github.com/research/ekoparty-ctf/

[META] Secure GitHub Actions through education, documentation, and practice

Description

I like GitHub Actions a lot. And there's a lot to learn. So let's make sure we understand how to use them securely.

Tasks

• #5
• #6
• #7
• #8

Document your findings about GHA into a playbook for future uses

Knowing how to secure (and test for exploits) is cool, but won't do much good if it's not written down.