#secdevops

Over the years I have been part of many discussions around a classic debate around red team versus blue team, the value of penetration testing, and the value they each bring. I started my InfoSec career in 1996 doing pentesting (aka red teaming) a couple years before it really exploded. For nine years that was my life and it often meant working crazy hours. My final gig doing it was with BT-INS…

Benefits of Implementing DevSecOps

podman a Real Docker Alternative

What is podman? podman is a container management tool that offers similar features like Docker for managing containers. One of the best features of podman is its ability to run rootless containers. A rootless container is a concept of running and managing containers without root privileges. From a security standpoint, rootless containers add an additional layer of security by not allowing root…

1. Steampipe AWS Compliance2. Steampipe AWS Insights3. Steampipe AWS Tags4. Steampipe AWS Perimeter5. Steampipe AWS Thrifty Stay Safe ☘️

AWS / Cloud / SecDevOps: Know Your Environment Part III

A quick look at the three most promising open source cloud inventory tools on the market today, part III “Steampipe”. https://github.com/turbot/steampipe Steampipe is by far the easiest solution to start with, within a few minutes you have some visualisation to show. Where as the other 2 solutions, CloudQuery and Resoto, need some more configuration and tweaking and more resources like…

AWS / Cloud: Know Your Environment Part II

A quick look at the three most promising open source cloud inventory tools on the market, part II “CloudQuery” osx: brew install cloudquery/tap/cloudquery [upgrade: brew upgrade cloudquery] terminal: cloudquery init aws docker: https://www.docker.com/products/docker-desktop/ docker: docker run --name cloudquery_postgres -p 5432:5432 -e PASSWORD =pass -d postgres aws: configure aws profiles in…

AWS / Cloud / SecDevOps: Know Your Environment Part I

A quick look at the three most promising open source cloud inventory tools on the market today, part I “Resoto”. Getting Started with Resoto on AWS Resoto installation on OSX: git clone https://github.com/someengineering/resoto.gitcd resotogit checkout tags/2.3.2docker compose up -ddocker compose run –rm resotoshell [update: docker compose up -d]config edit resoto.workeradd ‘aws’ to the list…

SecDevOps is the process of integrating secure development best practices and methodologies into the development and deployment processes that DevOps makes possible.

SecDevOps helps bridge the gap between continuous release cycles and security needs by addressing security at every stage of the SDL.