Questions tagged [devops]

DevOps is a culture, movement or practice that emphasizes the collaboration and communication of both software developers and other information-technology (IT) professionals while automating the process of software delivery and infrastructure changes.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

What tools exist to integrate a open source secrets detector into a deployment pipeline and Github? [migrated]

There are a number of open source secrets detectors that run via CLI. (Gitrob, trufflehog) However, is there a good way to integrate these that they run on a per PR basis? The use case here would be ...
1
vote
0answers
36 views

Security Team and Security in a small-medium organization/startup [closed]

How should one structure and how should a Security Team work in an agile organization (100 devs). Found this article: https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
0
votes
0answers
52 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
0
votes
0answers
37 views

Open source project using encrypted API keys

My API keys are encrypted with AES256 and will be decrypted in the code pipeline for a new release for every change to the repo (no more manual builds and no more manual upload to appstore). ( https:/...
3
votes
0answers
49 views

Secure a Jenkins node to only run approved scripts?

We have a series of Jenkins nodes that are used to deploy changes onto our SQL Servers, which works fine as long as everyone behaves and can be trusted. The worry is that a rogue developer or hacker ...
0
votes
0answers
43 views

Live Memory Analysis

I'm a developer working on a POC for an internal web app (Python\SQL) which will handle sensitive employee information within our company. In going over the application with our security department to ...
3
votes
1answer
200 views

Antivirus settings for developers and build machines?

I work in a company that has strict antivirus policy. Each computer must have an up-to date antivirus with all the bells and whistles turned on. But as a developers, this is giving us problems. ...
1
vote
2answers
86 views

Security implications of source code location

Were working towards implementing a SDLC for a company and as in any complex environment there are differences of opinion for the new process. Some of the developers want to make use of one directory ...
0
votes
0answers
62 views

Best Practices for Securing a network for Developers?

Asking as a developer: There seems to be a lot of tension between what developers want/need and what the Security Team would like to have locked down at a lot of development shops. Approved ...
1
vote
0answers
51 views

Secure API access with mobile apps in restricted environments

In our current project, IT rules prohibit anything that is not PROD to be publicly accessible from the Internet. Access to development and review environments must be severely restricted. That said, ...
6
votes
3answers
155 views

Security Testing Methods for Enterprise Level

I have been asked to perform risk assessment for a company. The scope covers about 100 applications and in various business units. Major task is to assess currently implemented security controls and ...
1
vote
1answer
102 views

Applying IT Sarbanes-Oxley (SOX) to a tool management application

Does an application that manages access controls to a suite of tools (Jenkins, Nexus, BitBucket) in a SOX environment need to be considered a SOX application? The app itself only deals with data in ...
1
vote
0answers
41 views

Dev(Sec)Ops - Analysis and testing frameworks for developers

I work in a development team and we are looking at moving into DevOps with a "shift left" approach with regards to security to bring us inline with DevSecOps What analysis and testing frameworks are ...
1
vote
0answers
93 views

Ideas for a security framework for DevOps [closed]

I am trying to put together a security control framework based on people process and technology for DevOps operating practices - what controls do you think must be included?
3
votes
1answer
1k views

Difference between AppSec Pipeline vs DevSecOps

There is thing about implementing security in the early phases. Owasp mention implementing through AppSec Pipeline. DevOps folks talk about DevSecOps. Looking at the diagrams and phases of ...
25
votes
2answers
1k views

Juggling bus factor & separation of duties on a small team?

I am lead dev on a team of five people. Only three are coders. And only the coders are really technical enough to do a roll-out of our application to a production server. Our app is pretty ...
5
votes
1answer
563 views

Security in automated systems using Puppet and Chef

In an extremely interesting presentation at Puppet Camp London, Tomas Doran suggested a pretty radical approach for keeping everything automated by managing tons of Docker containers with Puppet. As ...