Questions tagged [devsecops]
Use this tag for questions about DevOps and Security
22
questions
0
votes
1
answer
510
views
Why is detect-secrets-hook ignoring my audit selections?
detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.
I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.
To ...
CommunityBot
- 1
1
vote
2
answers
93
views
Need to understand the career path for DevOps
I am a frontend developer, planning to gain hands on experience in DevOps. However, I'm not sure of if only DevOps or DevSecOps.
Recently I tried learning Jenkins while last year took an Udemy course ...
- 247
0
votes
1
answer
19
views
I activated all three API Keys on my Etherscan.io account, was I only suppose activate one (1), not three (3)? [closed]
I am new to web3, cloud, C++, CLI, Meta and Stack. This is all a new world a new platform for me. I have no one on one teacher I started off being a service (gig) worker to Content Creator-to-...
- 343
-1
votes
1
answer
247
views
How do I install BlackDuck on mac?
I am trying to scan container images using the blackdock scanning tool. Unfortunately, I couldn't find any free version to play around with; please provide guidance and the simplest way to scan the ...
- 7,205
1
vote
1
answer
325
views
How to avoid disclosing account ID in AWS ARN
I'm new to the AWS ecosystem and have what might be a naive question. While trying to create a GlueRunner Lambda stack with CloudFormation (using pynt), from the Cloud9 shell of an account with all ...
CommunityBot
- 1
0
votes
1
answer
45
views
Collaboration tools recommendations like Slack
I started my graduation internship two weeks ago. My assignment is to look for a Slack alternative that'll be able to deploy on-premise. A lot of things need to be automated. I already did some ...
- 11
2
votes
1
answer
69
views
Continuous deployment strategies vs DevSecOps
How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here?
Security requirements may differ, let's assume this simple level of ...
- 6,782
0
votes
0
answers
18
views
Fuzz testing web service in development environment
I would like to fuzz test our web services in our development environment but I do not want to pollute the database with data from the fuzz test. We do not currently have an automated way of creating ...
- 193
0
votes
1
answer
46
views
Is there a limitation in AWS to open an IPSec VPN connection?
Consider the following situation (for test purposes):
there is a public IPSec VPN endpoint (StrongSwan);
a machine with either Ubuntu (Strong Swan client) or Windows OS (native client) running in the ...
CommunityBot
- 1
1
vote
2
answers
125
views
How securely to keep google cloud service account key?
How securely to keep google cloud service account key?
I want to ask about how we should securely keep service account key. The scenario looks like:
Our product is connecting to BigQuery.
We have ...
- 666
2
votes
3
answers
118
views
What are trusted providers that offer wildcard certificates and associated costs to be used in an Orchestration Platform like Kubernetes?
Currently, certbot and nginx are used to create a trusted webpage. Recently, an attempt was made to move the images to a kubernetes cluster on google cloud platform. A guide was found to configure an ...
- 549
1
vote
1
answer
280
views
Mitigating Docker Compliance Issues - Can I put everything in the `daemon.json`?
I am going through compliance tasks to harden our Docker setup and I am seeing many things like
Favor using docker run with docker run --pids-limit 100 to prevent forkbombs
Favor using docker run ...
- 2,762
5
votes
1
answer
201
views
Why unable to find the exact path for grains storage in master?
I am trying to completely remove the grains from the system. I have one master and one minion setup(minion id= minion1). I am doing
salt minion1 grains.ls
that is listing me all the grains
Now I ...
CommunityBot
- 1
48
votes
7
answers
4k
views
What are best and comprehensive practices to consider when running docker in production?
Finally, you are so much in love with Docker that you want to move your online business-critical production systems with sensitive customer data to a Docker Swarm. Some might even already have done so....
- 13.3k
0
votes
1
answer
2k
views
Devops Jenkins nexus integration?
I want to try to upload any set of artifacts from any type of project ( Java, node, PHP, .net, go ).
I know that once a developer pushes a code to git, Jenkins should take it and run the test case on ...
CommunityBot
- 1
4
votes
1
answer
399
views
How to securely pass sensitive data to EC2 Spot instances?
Right now, we only use EC2 on-demand instances, and we provision sensitive data (credentials, private keys, etc.) on the instances' EBS which are encrypted with a KMS key.
My understanding is that I ...
- 1,112
3
votes
3
answers
98
views
How to raise awareness about the security risk involved with running Docker?
I'm in the process of preparing a Docker course for students with little to no familiarities with containers, the underlying OS mechanisms involved, and their implied limitations.
In many Docker ...
- 4,906
0
votes
2
answers
361
views
CIS Benchmark for Docker and Docker Bench for Security: why, how and when?
I just learned about Docker Bench for Security and CIS Benchmark for Docker Community Edition.
Why, how and when am I supposed to use these tools?
- 1,172
3
votes
2
answers
171
views
Mitigating Maven Central risks as seen from the DevSecOps perspective
AFAIK there are two official primary repositories for Maven packages (Java language):
search.maven.org offered by Sonatype Inc.
mvnrepository.com offered by a private person @frodriguez
Now ...
CommunityBot
- 1
2
votes
1
answer
649
views
Issue integrating acunetix with jenkins
The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My ...
- 103
1
vote
1
answer
274
views
Possibility of container breakout compared to VM (virtual machines)
What is exactly the (higher) vulnerability at least theoretically of a container compared to VM? given, all security recommendations are implemented (like, user context is root, no host sensitive ...
- 6,782
0
votes
1
answer
56
views
What percentage of microservice architectures employ polyglot programming models?
One of the tenets of microservices is the polyglot, autonomous services (developed in different programming languages). In my experience (online reading and YouTube and discussions with developers) it ...
- 6,782