👉🏼 ➖ 🍬 Da modelagem de ameaças à segurança da AWS: mais de 50 ferramentas de código aberto para a construção de segurança DevOps 🚱 🧑🏾‍🤝‍🧑🏾 🕠

Olá, Habr! Sou consultor de segurança da informação na Swordfish Security para criar DevOps seguros para nossos clientes. Acompanho a tendência de desenvolvimento das empresas em direção ao DevSecOps no mundo, procuro difundir as práticas mais interessantes para a comunidade de língua russa e ajudo a construir esse processo com nossa equipe junto aos clientes. Nos últimos 2 anos, o DevSecOps tem recebido cada vez mais atenção. Novas ferramentas não têm tempo para fazer parte do conjunto de práticas em rápido crescimento, o que me fez querer colocar algum tipo de checkpoint na forma de uma lista de ferramentas. O ponto de partida foi o lançamento do artigocolegas da Mail.ru, onde uma seção sobre segurança do Kubernetes foi destacada separadamente. Decidi expandir essa lista para cobrir outros estágios do ciclo de vida do SDLC e fornecer algumas ferramentas novas.

Prática significa um conjunto de medidas que podem ser construídas em um dos estágios do SDLC / DevOps (modelagem de ameaças, SAST, DAST, SCA, digitalização de imagem Docker, digitalização Kubernetes, auditoria AWS, etc.).

Índice

Uma das visões das práticas DevSecOps. Fonte: https://holisticsecurity.io/2020/02/10/security-along-the-container-based-sdlc

Dev

Modelagem de Ameaças

Secure Development Lifecycle . , . , backlog. , , DevSecOps “Shift security to the left”.

IT-, . open-source , .

OWASP Threat Dragon

OWASP Threat Dragon

. , , STRIDE. , , , . GitHub.

Exemplo de diagrama do Threat Dragon — Threat Dragon

Pytm

Pytm

Pytm - Python .

Pytm , . .

Materialize threats tool

Materialize-threats - Python, draw.io , SQL . Gherkin.

open-source , , Enterpise- Irius Risks.

.drawio, data flow
, Rapid Threat Model Prototyping methodology( readme )
.drawio
materialize.py .drawio
Gherkin.

Arquitetura de amostra em draw.io como entrada para a ferramenta Materializar ameaças — draw.io Materialize threats tool

O resultado da ferramenta Materializar ameaças — Materialize threats tool

open-source :

, , , , :

Awesome threat modeling

(SAST):

, . . Open-source , , , - . :

, .

Salus

Salus

, , Bandit, Gosec, Brakeman, open-source (Ruby,Node.js, Python,Go). :

# Navigate to the root directory of the project you want to run Salus on
$ cd /path/to/repo

# Run the following line while in the root directory (No edits necessary)
$ docker run --rm -t -v $(pwd):/home/repo coinbase/salus

JSON/YAML . GitHub CircleCI.

ShiftLeft Scan

ShiftLeft Scan

Salus, . , docker (gosec, find-sec-bugs, psalm, bandit, …). Docker terraform, bash, kubernetes .

Python :

$ docker run --rm -e "WORKSPACE=${PWD}" -v "$PWD:/app" shiftleft/sast-scan scan --src /app --type python

, IDE.

Exemplo de integração de código VS para ShiftLeft — VS Code ShiftLeft

GitLab SAST

SAST GitLab

Gitlab DevOps , , open-source SAST, . Gitlab SCA, , fuzzing DevSecOps, Gold-.

Um exemplo de incorporação de SAST no pipeline GitLab. — SAST GitLab.

LGTM

LGTM

LGTM - Semmle, GitHub. Semmle CodeQL , GitHub - Satellite.

Semgrep

Semgrep

, . , , AST Data flow, . , :

$ semgrep --config=&lt;path/to/config> path/to/src

semgrep :

rules:
- id: user-eval
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-either:
    - pattern: eval(..., request.$W.get(...), ...)
    - pattern: |
        $V = request.$W.get(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W(...), ...)
    - pattern: |
        $V = request.$W(...)
        ...
        eval(..., $V, ...)
    - pattern: eval(..., request.$W[...], ...)
    - pattern: |
        $V = request.$W[...]
        ...
        eval(..., $V, ...)

Semgrep , ( , semgrep ):

Resultado da pesquisa Semgrep da versão em nuvem da ferramenta — Semgrep

. , open-source , SAST, . CWE , - . , , CWE CVE.

open-source - SCA

, , open-source, . ( , Equifax). , SCA , , .

Dependency Check

Dependency Check

Dependency Check - open-source OWASP . , , . , Secure SDLC . Dependency Check , , , , Dependency Track.

# Dependency Check Maven Plugin example
$ mvn org.owasp:dependency-check-maven:check

Captura de tela do relatório de verificação de dependência HTML — HTML- Dependency Check

Dependency Track

Dependency Track

Dependency Track - OWASP, -, Software bill of materials (SBOM) CycloneDx. Dependency Track BOM, , , NVD. Slack, Microsoft Teams, .

# CycloneDx Maven Plugin example to make SBOM
$ mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom

Captura de tela da interface da web do Dependency Track. — - Dependency Track.

Snyk Open-source

Snyk Open-source

Snyk , open-source , SaaS-. (GitHub, Bitbucket), CLI.

Captura de tela da plataforma SaaS de código aberto Snyk para o projeto Python — SaaS- Snyk open-source Python-

snyk npm:

$ npm install -g snyk
$ snyk auth
$ snyk monitor

Sonatype Open-source

NVD ( ) Sonatype OSS, Sonatype, Nexus IQ. , , Nexus IQ SCA . Sonatype OSS - , Dependency Check Dependency Track. , Sonatype open-source SCA, Sonatype OSS:

Nexus Vulnerability Scanner - Sonatype
AuditJS - JS (NPM, Angular, yarn, bower)
Nancy - Golang
Jake - Conda
Chelsea - Ruby
Cheque - C/C++ (GCC)
Ahab - apt, apk, yum, dnf
Pants - Rust (Cargo)
Sonatype Depshield - GitHub

Captura de tela do relatório do Nexus Vulnerability Scanner — Nexus Vulnerability Scanner

SCA:

SCA OWASP
ClearlyDefined
Renovate - White Source
Dependabot - GitHub open-source GitHub

, open-source , , , . , , . , . , .

git-secrets

git-secrets

$ git secrets --scan /path/to/file

Gitrob

gitrob

$ export GITROB_ACCESS_TOKEN=&lt;TOKEN>
$ gitrob &lt;target>

Gitleaks

gitleaks

$ gitleaks --repo-path=&lt;path to repo>
$ gitleaks --repo=&lt;url of github>

Github-action.

TruffleHog

TruffleHog

$ trufflehog [-h] [--json] [--regex] [--rules RULES]
                  [--entropy DO_ENTROPY] [--since_commit SINCE_COMMIT]
                  [--max_depth MAX_DEPTH]
                  git_url

TruffleHog - , , .

GitGuardian

GitGuardian

SaaS . on-prem . .

. Password Vault (HashiCorp Vault, conjur, …)

(DAST):

Arachni

Arachni

open-source , . Docker-, CLI -. , . CWE-.

Docker:

$ docker run -d \
    -p 222:22 \
    -p 7331:7331 \
    -p 9292:9292 \
    --name arachni \
    arachni/arachni:latest

, REST API 7331 json.

OWASP ZAP

OWASP ZAP

open-source , CI/CD. GUI, CLI docker-. .

# OWASP ZAP as a daemon
docker run -p 8090:8090 -i owasp/zap2docker-stable zap.sh -daemon -port 8090 -host 0.0.0.0
# OWASP ZAP runs for 1  minute and then waits for the passive scanning to complete before reporting the results.
docker run -t owasp/zap2docker-weekly zap-baseline.py -t https://www.example.com

Kubernetes-.

, . , Arachni 10 , ZAP , , , .

w3af

w3af

, (, 2012 (https://xakep.ru/2012/11/09/w3af-pentest/)), docker- CI/CD

, open-source Jenkins AWS, w3af.

docker:

$ git clone https://github.com/andresriancho/w3af.git
$ cd w3af/extras/docker/scripts/
$ sudo ./w3af_console_docker

w3af. : https://xakep.ru/2012/11/09/w3af-pentest/

. -. .

, open-source enterprise, . DAST .

Behaviour Driven Development

Behavioral Driven Development (BDD) ( “ ”)- , Test Driven Development (TDD) (“ ”). , , , , . BDD - Gherkin.

, .

Gauntlt

Guantlt - , Behavioral Driven Development. Arachni, nmap, sslyze, sqlmap Gherkin.

# nmap-simple.attack
Feature: simple nmap attack to check for open ports

  Background:
    Given "nmap" is installed
    And the following profile:
      | name     | value       |
      | hostname | example.com |

  Scenario: Check standard web ports
    When I launch an "nmap" attack with:
      """
      nmap -F <hostname>
      """
    Then the output should match /80.tcp\s+open/
    Then the output should not match:
      """
      25\/tcp\s+open
      """

, Guantlt “” , .

. Guantlt BDD-Security, OWASP ZAP, Tenable Nessus Scanner.

Docker:

, Docker ( Docker DevOps), Docker- .

, , .

Clair

Clair

CVE . UI , Klar.

$ docker run -d -e POSTGRES_PASSWORD="" -p 5432:5432 postgres:9.6
$ docker run --net=host -d -p 6060-6061:6060-6061 -v $PWD/clair_config:/config quay.io/coreos/clair:latest -config=/config/config.yaml

Klar

Klar

API Clair.

$ mkdir klar &amp;&amp; cd klar &amp;&amp; wget https://github.com/optiopay/klar/releases/download/v2.4.0/klar-2.4.0-linux-amd64 -O klar &amp;&amp; chmod +x klar
$ CLAIR_ADDR=http: //localhost:6060 CLAIR_THRESHOLD=10 ./klar &lt;docker image>

Trivy

Trivy ( Alpine, RedHat (EL), CentOS, Debian GNU, Ubuntu) (Gemfile.lock, Pipfile.lock, composer.lock, package-lock.json, yarn.lock, Cargo.lock) Clair , , .tar Docker .

# Download bin
$ wget https: //github.com/knqyf263/trivy/releases/download/v0.1.3/trivy_0.1.3_Linux-64bit.deb
$ dpkg -i ./trivy_0. 1 .3_Linux-64bit.deb
# Scan image
$ trivy bkimminich/juice-shop
# Scan image in tar
$ trivy -i ./ my_saved_docker_image.tar

Anchore

Anchore

Docker. REST API CLI.

$ anchore-cli --u admin --p foobar image add httpd:latest
$ anchore-cli --u admin --p foobar image vuln httpd:latest all

Anchore. : https://swordfishsecurity.ru/blog/obzor-utilit-bezopasnosti-docker

AquaMicroscanner

Aqua Security, Trivy.

$ docker run --rm -it aquasec/microscanner --register &lt;email address>

ADD https://get.aquasec.com/microscanner /
RUN chmod +x /microscanner
RUN /microscanner &lt;TOKEN> [--continue-on-failure]

. CVE :

Dagda

Dagda , Dependency Check, Retire.js ClamAV .

$ export DAGDA_HOST='127.0.0.1'
$ export DAGDA_PORT=5000
$ python3 dagda.py vuln --init
$ python3 dagda.py check --docker_image jboss/wildfly

Docker bench

Docker Bench

Docker bench - compliance- , .

CIS Benchmarks Docker.

$ docker run -it --net host --pid host --userns host --cap-add audit_control \
      -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
      -v /etc:/etc:ro \
      -v /usr/bin/containerd:/usr/bin/containerd:ro \
      -v /usr/bin/runc:/usr/bin/runc:ro \
      -v /usr/lib/systemd:/usr/lib/systemd:ro \
      -v /var/lib:/var/lib:ro \
      -v /var/run/docker.sock:/var/run/docker.sock:ro \
      --label docker_bench_security \
      docker/docker-bench-security

Dockle

Dockle

compliance-, , CIS.

$ docker run --rm goodwithtech/dockle:v${DOCKLE_LATEST} [YOUR_IMAGE_NAME]

Ops:

Kubernetes Security

Deploy. Kubernetes, Docker, Kubernetes , Kubernetes .

My Arsenal of Cloud Native (Security) Tools by MARCO LANCINI

Kube-bench

Kube-bench

( ) Aqua Security. CIS Kubernetes Benchmark Kubernetes ( GKE, EKS and AKS)

# Run inside a container
$ docker run --rm --pid=host                      \
   -v $(which kubectl):/usr/bin/kubectl         \
   -t aquasec/kube-bench:latest <master|node>

# Run in a cluster - on master node
$ kubectl run                                          \
      --rm                                             \
      -it                                              \
      kube-bench-master                                \
      --image=aquasec/kube-bench:latest                \
      --restart=Never                                  \
      --overrides="{ \"apiVersion\": \"v1\",           \
          \"spec\": { \"hostPID\": true,               \
          \"nodeSelector\":                            \
          { \"kubernetes.io/role\": \"master\" },      \
          \"tolerations\": [ {                         \
          \"key\": \"node-role.kubernetes.io/master\", \
          \"operator\": \"Exists\",                    \
          \"effect\": \"NoSchedule\" }]}}"             \
      -- master                                        \
      --version 1.8

# Run in a cluster - on worker nodes
$ kubectl run                                \
      --rm                                   \
      -it                                    \
      kube-bench-node                        \
      --image=aquasec/kube-bench:latest      \
      --restart=Never                        \
      --overrides="{ \"apiVersion\": \"v1\", \
          \"spec\": { \"hostPID\": true } }" \
      -- node                                \
      --version 1.8

Kubernetes Auto Analyzer

Kubernetes Auto Analyzer

, Kube-bench, . Kube-bench Aqua Security.

# Put the config file in a directory and mount it to the /data folder
$ docker run --rm                               \
      -v /data:/data raesene/kube_auto_analyzer \
      -c /data/admin.conf -r testdock

# Provide a KUBECONFIG file to identify and authenticate the session
$ kubeautoanalyzer -c <kubeconfig_file_name> -r <report_name> --html

Kube-hunter

Kube-hunter

Kubernetes. , IP- / Kubernetes.

# Run from docker
$ docker run -it --rm --network host aquasec/kube-hunter

# Run from kubectl
$ kubectl run --rm -it                        \
     kube-hunter                            \
     --image=aquasec/kube-hunter            \
     --restart=Never                        \
     --overrides="{ \"apiVersion\": \"v1\", \
     \"spec\": { \"hostNetwork\": true } }"

KubiScan

KubiScan

RBAC- Kubernetes.

, CyberARK.

# Run from MASTER node
$ docker run -it --rm -e CONF_PATH=~/.kube/config -v /:/tmp cyberark/kubiscan [CMD]

# Search for pods with privileged accounts
$ kubiscan -rp

# Show all risky subjects (users, service accounts, groups)
$ kubiscan -rs

# Show all the rules a service account has
$ kubiscan -aars "SANAME" -ns "default" -k "ServiceAccount"

# List service account RoleBindings
$ kubiscan -aarbs "SANAME" -ns "default" -k "ServiceAccount"

Krane

Krane

, RBAC RBAC RedisGraph. RBAC . Krane CLI, docker- , CI/CD.

Statboard

Starboard

, Kubernetes CustomResourceDefinitions (CRDs) trivy, kube-bench, kube-hunter. Starboard kubectl- Octant, Kubernetes.

$ starboard find vulnerabilities deployment/nginx --namespace dev
$ starboard get vulnerabilities deployment/nginx \
  --namespace dev \
  --output yaml

Kubeaudit

Kubeaudit

, Kubernetes.

# Run from kubectl (as plugin)
$ kubectl audit all

Kubesec

Kubesec

Kubernetes .

$ krew install kubesec-scan
$ kubectl kubesec-scan pod <podname>

Deepfence Runtime Threat Mapper

Deepfence Runtime Threat Mapper

community- . , , CI/CD , Registry. SIEM, Slack, Jira, Amazon S3 ( ).

Sysdig Falco

Sysdig Falco

run-time Sysdig, .

Vulnerability Management

SAST, DAST, SCA, Docker Kubernetes, . Vulnerability Management . , API - -. AppSec.Hub, , DevSecOps- CI/CD . open-source .

DefectDojo

DefectDojo

OWASP. (22+) open-source (ZAP, Trivy, nmap, Dependency Check), enterprise (Veracode, Checkmarx, Twistlock). , API.

Secure code Box

Secure code box

Open-source , (ZAP, NMAP, Nikto, Arachni), docker-compose Kibana Elasticsearch. DefectDojo, , ( issue ). UI. -.

, , one-button-click-solution .

Archery

Archery

open-source . Acuntetix, Nessus, Burp, Netsparker, WebInspect. DefectDojo, , ZAP, Burp OpenVAS. , false positive. CI/CD.

vulnerability management:

Public Cloud Security

DevOps (AWS, GCP, Azure, Oracle) on-prem .

, . , , .

AWS. :https://cloudseclist.com/issues/issue-42/

AWS-inventor

AWS-inventor

AWS AWS.

$ python aws_inventory.py
# Select the generated JSON file when prompted
$ firefox gui/dist/index.html

Aws-public-ips

AWS-puclic-ips

AWS ip-.

# Uses default ~/.aws/credentials
$ aws_public_ips -f json -s apigateway,cloudfront,ec2, \
    elasticsearch,elb,elbv2,lightsail,rds,redshift
# With a custom profile
$ AWS_PROFILE=production aws_public_ips ...

CloudSploit

CloudSploit

compliance- AWS, GCP, Azure, OCI. , CIS PCI DSS.

# Edit the&nbsp;index.js&nbsp;file with your AWS key and secret
# Run a standard scan
$ node index.js
# Run a compliance scan
$ node index.js --compliance=hipaa

AWS Security Benchmark

AWS Security Benchmark

AWS CIS Amazon Web Services Foundations Benchmark 1.1.

$ python aws-cis-foundation-benchmark-checklist.py

S3 Scan

S3 Scan

, S3- .

$ python s3scan.py [-f &lt;format>] [-p &lt;profile>]

. , AWS Security:

My-arsenal-of-aws-security-tools

G-Scout

G-Scout

, GCP.

# Permissions required on the projects: Viewer, Security Reviewer, Stackdriver Account Viewer
$ python gscout.py --project-id <projectID>

ScoutSuite

ScoutSuite

GCP, AWS, Oracle, Azure.

# GCP example
# Using an user account
$ python Scout.py --provider gcp --user-account --project-id <projectID>
# Using a service account
$ python Scout.py --provider gcp                                     \
                  --service-account --key-file service_account.json  \
                  --project-id <projectID>

?

, , DevOps/SDLC. , . , IaC. , . BSIMM OWASP SAMM.

, .

RASP - , , ( , , .). Container Run-time Security ( Sysdig Falco). RASP -:

OpenRASP

IAST - , SAST DAST:

Contrast

Fuzzing - , , :

Awesome Fuzzing

IaC Security - :

Cfn Nag - AWS CloudFormation
Checkov - Terraform, AWS CloudFormation Kubernetes
Terrascan - Terraform
Tfsec - Terraform AWS, Azure GCP.
Kubernetes YAML validating:

Compliance-as-code - :

Security Chaos Engineering - , : "" , , , "" . , . - , . Security Chaos Engineering Chaos Engineering , . , , Security Groups, , , VPC, "" . , . :

DevSecOps :

DevSecOps Wine - DevSecOps
DevSecOps Wine Chat -
CloudSec Wine - Public Cloud Security
Mobile AppSec World -
DevSecOps

UPD.

, Awesome DevSecOps , :

Awesome DevSecOps

Da modelagem de ameaças à segurança da AWS: mais de 50 ferramentas de código aberto para a construção de segurança DevOps

Índice

Dev

Modelagem de Ameaças

OWASP Threat Dragon

Pytm

Materialize threats tool

(SAST):

Salus

ShiftLeft Scan

GitLab SAST

LGTM

Semgrep

open-source - SCA

Dependency Check

Dependency Track

Snyk Open-source

Sonatype Open-source

git-secrets

Gitrob

Gitleaks

TruffleHog

GitGuardian

(DAST):

Arachni

OWASP ZAP

w3af

Behaviour Driven Development

Gauntlt

Docker:

Clair

Klar

Trivy

Anchore

AquaMicroscanner

Dagda

Docker bench

Dockle

Ops:

Kubernetes Security

Kube-bench

Kubernetes Auto Analyzer

Kube-hunter

KubiScan

Krane

Statboard

Kubeaudit

Kubesec

Deepfence Runtime Threat Mapper

Sysdig Falco

Vulnerability Management

DefectDojo

Secure code Box

Archery

Public Cloud Security

AWS-inventor

Aws-public-ips

CloudSploit

AWS Security Benchmark

S3 Scan

G-Scout

ScoutSuite

?

More articles: