Questions tagged [devops]
DevOps is a culture, movement or practice that emphasizes the collaboration and communication of both software developers and other information-technology (IT) professionals while automating the process of software delivery and infrastructure changes.
23 questions
1
vote
1
answer
90
views
Do CI/CD pipelines in Azure DevOps require a dedicated user without MFA?
During security audits I've seen several times that DevOps made a 'special' user account for CI/CD pipelines, especially when using Azure DevOps. Often this user is the only user where multi-factor ...
- 7,055
0
votes
0
answers
93
views
Are centralized credentials an antipattern?
At my organization we have a lot of servers. We have many common manual maintenance tasks that we'd like to automate. There's currently three approaches we're fighting over internally:
Ops engineers ...
- 1
0
votes
0
answers
84
views
Deploying a site with zero-knowledge?
Any methodologies of secret or private dev-ops as a service?
The use-case I was thinking of is for example, a productized service like on Fiverr, eg. Seller will deploy your site onto TOR network and ...
- 113
0
votes
2
answers
691
views
Restricting Developers access to Production in DevOps?
In a devops context, how do you approach seperating development from production environments (which is an ISO27001:2022 Annex A control) ? Is granting developers access to production a necessary evil ...
- 1,998
0
votes
0
answers
88
views
Is there much practical security value in using passwords/usernames for postgres instances used on development machines?
So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
- 101
0
votes
0
answers
128
views
AWS IAM Access Issue
We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
0
votes
1
answer
229
views
What exploit is trying to be leveraged here? (Apache access.log)
I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al.
I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
- 1
0
votes
1
answer
282
views
Managing vulnerabilities in continuous delivery
When building my own Docker container, if I use a base image such as Debian 10.6 (stable) there are times when high vulnerabilities are found in the OS packages, that have not been fixed in this ...
- 3
1
vote
0
answers
121
views
Security Team and Security in a small-medium organization/startup [closed]
How should one structure and how should a Security Team work in an agile organization (100 devs).
Found this article:
https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
- 1,007
0
votes
0
answers
132
views
Can we know which client side script is performing a particular action on a website?
Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
- 1
3
votes
0
answers
127
views
Secure a Jenkins node to only run approved scripts?
We have a series of Jenkins nodes that are used to deploy changes onto our SQL Servers, which works fine as long as everyone behaves and can be trusted.
The worry is that a rogue developer or hacker ...
- 131
0
votes
0
answers
115
views
Live Memory Analysis
I'm a developer working on a POC for an internal web app (Python\SQL) which will handle sensitive employee information within our company. In going over the application with our security department to ...
- 1
5
votes
1
answer
1k
views
Antivirus settings for developers and build machines?
I work in a company that has strict antivirus policy. Each computer must have an up-to date antivirus with all the bells and whistles turned on.
But as a developers, this is giving us problems.
...
- 153
1
vote
2
answers
164
views
Security implications of source code location
Were working towards implementing a SDLC for a company and as in any complex environment there are differences of opinion for the new process. Some of the developers want to make use of one directory ...
- 1,224
0
votes
0
answers
159
views
Best Practices for Securing a network for Developers?
Asking as a developer:
There seems to be a lot of tension between what developers want/need and what the Security Team would like to have locked down at a lot of development shops.
Approved ...
- 109
1
vote
0
answers
137
views
Secure API access with mobile apps in restricted environments
In our current project, IT rules prohibit anything that is not PROD to be publicly accessible from the Internet. Access to development and review environments must be severely restricted. That said, ...
- 143
6
votes
3
answers
236
views
Security Testing Methods for Enterprise Level
I have been asked to perform risk assessment for a company. The scope covers about 100 applications and in various business units. Major task is to assess currently implemented security controls and ...
- 61
1
vote
1
answer
213
views
Applying IT Sarbanes-Oxley (SOX) to a tool management application
Does an application that manages access controls to a suite of tools (Jenkins, Nexus, BitBucket) in a SOX environment need to be considered a SOX application?
The app itself only deals with data in ...
- 125
1
vote
0
answers
120
views
Dev(Sec)Ops - Analysis and testing frameworks for developers
I work in a development team and we are looking at moving into DevOps with a "shift left" approach with regards to security to bring us inline with DevSecOps
What analysis and testing frameworks are ...
- 297
1
vote
0
answers
174
views
Ideas for a security framework for DevOps [closed]
I am trying to put together a security control framework based on people process and technology for DevOps operating practices - what controls do you think must be included?
- 11
4
votes
1
answer
2k
views
Difference between AppSec Pipeline vs DevSecOps
There is thing about implementing security in the early phases. Owasp mention implementing through AppSec Pipeline. DevOps folks talk about DevSecOps. Looking at the diagrams and phases of ...
- 1,293
25
votes
2
answers
2k
views
Juggling bus factor & separation of duties on a small team?
I am lead dev on a team of five people. Only three are coders. And only the coders are really technical enough to do a roll-out of our application to a production server.
Our app is pretty ...
- 359
5
votes
1
answer
655
views
Security in automated systems using Puppet and Chef
In an extremely interesting presentation at Puppet Camp London, Tomas Doran suggested a pretty radical approach for keeping everything automated by managing tons of Docker containers with Puppet.
As ...
- 6,843