Questions tagged [security]

For questions related to IT Security, Information Security or DevSecOps.

Filter by
Sorted by
Tagged with
63 votes
7 answers
27k views

How can I manage secrets in .tf and .tfstate?

I would like to use the Terraform MySQL Provider to keep a list of mysql users and grants handy for creating new test environments. The .tf and .tfstate files both seem to want to store the MySQL ...
Anthony Neace's user avatar
47 votes
7 answers
4k views

What are best and comprehensive practices to consider when running docker in production?

Finally, you are so much in love with Docker that you want to move your online business-critical production systems with sensitive customer data to a Docker Swarm. Some might even already have done so....
Ta Mu's user avatar
  • 6,802
34 votes
5 answers
24k views

Where to put ansible-vault password

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. The idea is to put all our sensitive data into a plain file then encrypt this file with ansible-vault ...
storm's user avatar
  • 1,759
26 votes
6 answers
16k views

How to prohibit access to internals of Docker container?

I want to deliver my app to customers in form of docker image. But it is crucial to ensure that end-user do not alter anything inside the container. User should only be able to run/stop the container ...
Victor Mezrin's user avatar
24 votes
2 answers
11k views

What Is SecOps?

First when I heard the word SecOps, I thought of it as a management approach that aims to connect security and operations teams, in much the same way that DevOps unifies developers and operations team....
storm's user avatar
  • 1,759
15 votes
2 answers
6k views

How to store credentials that are required by an application?

Everyone is saying that storing credentials in version control (git) is a bad thing. So there must be other ways to store credentials which are much better. An application must receive credentials ...
Evgeny Zislis's user avatar
14 votes
4 answers
7k views

Open Ports on Google Cloud Load Balancer

It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the ...
bootbeast's user avatar
  • 189
14 votes
2 answers
5k views

Is it bad to use sudo from Jenkins?

I use Publish Over SSH plugin to deploy my apps from Jenkins to different environments. Some deployment jobs do environment preps and things like stop and restart the app server system service. Some ...
amphibient's user avatar
13 votes
2 answers
3k views

Does `npm audit` add any value when using `dependabot`

Context There are multiple ways to scan projects for vulnerabilities. Dependabot can be configured to check repositories for issues, and automatically submits pull requests to resolve. NPM Audit will ...
JohnLBevan's user avatar
12 votes
2 answers
404 views

How to storing encrypted secrets in code for a serverless.com project?

With serverless.com, the easiest way to expose a secret to an AWS Lambda function is to store it in the serverless.yml file (encrypted with KMS, for example). But committing encrypted secrets to Git ...
Assaf Lavie's user avatar
  • 1,241
8 votes
1 answer
7k views

What are the best practices for anti-virus / anti-malware when using containers?

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
Roly's user avatar
  • 183
8 votes
1 answer
7k views

Running the docker daemon without root

Inspired by What are best and comprehensive practices to consider when running docker in production? , I stumbled over Why we don't let non-root users run Docker... They came up with docker run -ti ...
AnoE's user avatar
  • 4,866
8 votes
3 answers
578 views

Running unmanaged Hardware Security Modules (HSMs) in the Cloud

I have to admit to never having asked, or been asked, the question if it is possible to have a Hardware Security Module in a public cloud, by which I mean Google, Amazon or Azure. Has anyone found ...
Richard Slater's user avatar
7 votes
4 answers
3k views

Ansible - private git repositories - SSH agent forwarding vs copying private SSH key

I recently started playing around with Ansible and it seems very nice. I don't have much experience in DevOps stuff and never really had to handle any complex scenarios. I started creating my Ansible ...
pzaj's user avatar
  • 171
7 votes
2 answers
12k views

How to only allow API Gateway requests to reach our EC2 instances

We have multiple EC2 instances hosting our micro-services. The autoscaling group of servers has an ELB. All traffic is routed via the AWS API Gateway. The problem is that the ELB has its HTTPS port ...
Evgeny Zislis's user avatar
7 votes
3 answers
464 views

When your micro service in production needs a secret, where is the secret stored and retrieved from?

The context of the question is Secrets management. How do you manage storing and retrieving secrets for your micro service which is in production?
Zvika Nadav's user avatar
7 votes
2 answers
743 views

What strategies can be employed to secure sensitive data in log files?

Working in highly regulated environments data is classified in different ways depending on the sensitivity. In some cases, this is legally enforced and must be treated differently. Examples of a data ...
Richard Slater's user avatar
6 votes
5 answers
12k views

How to list security groups for the specific instance via CLI?

I'm looking for syntax like: aws ec2 describe-security-groups --instance-id i-0xyz however, the above sub-command doesn't support --instance-id parameter. I've checked and there are --filters and --...
kenorb's user avatar
  • 7,781
6 votes
2 answers
152 views

Securing communication between cloud VMs without private networks. Any strategy besides building own VPN? Spiped?

I am working on an application that requires a number of different services (web application + database + worker queues, XMPP server for messaging, redis, central authentication via LDAP, etc). For my ...
lullis's user avatar
  • 161
5 votes
1 answer
3k views

Terraform: how do you inspect sensitive data?

In a resource of type aws_ecs_task_definition my plan has an line that looks like this: ~ container_definitions = (sensitive) # forces replacement Now in principle this could be doing anything - ...
Carl Patenaude Poulin's user avatar
5 votes
2 answers
5k views

Docker security risks passing secrets over environment variables

I'm new to Docker and want to put my Django web application into containers. For the last couple days I'm struggling with passing credentials safe to containers. Online there is always the hint ...
user3142459's user avatar
4 votes
2 answers
4k views

Docker MongoDB image - How to specify credentials other than in the compose file?

I'm using this docker image https://hub.docker.com/_/mongo/. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as ...
joe.js's user avatar
  • 143
4 votes
3 answers
237 views

What is the Prometheus and Grafana ideal setup?

I am just wondering. If I have many environments monitored via Prometheus, what will be the best configuration? The security and efficiency are already important for on-premise installations but ...
gervais.b's user avatar
  • 155
4 votes
1 answer
354 views

How to securely pass sensitive data to EC2 Spot instances?

Right now, we only use EC2 on-demand instances, and we provision sensitive data (credentials, private keys, etc.) on the instances' EBS which are encrypted with a KMS key. My understanding is that I ...
Philippe's user avatar
  • 155
4 votes
1 answer
610 views

How not expose my backend

I'm studying Docker and how to properly publish my containers coding a very simple web application. It has only two containers, backend and frontend. I've published the source code here: https://...
Sinayra's user avatar
  • 43
4 votes
1 answer
163 views

What are the real world benefits of RDS instance (at rest) encryption?

AWS offers at rest encryption for its RDS instances. I think this sounds nice, and it's something that comes up regularly on security reviews but I'm not sure what the real benefit is. The most likely ...
MrDuk's user avatar
  • 295
4 votes
1 answer
472 views

Docker Sign an Image with an existing Certificate

With respect to docker's security system. Is it possible to somehow get images signed by some entity that has trust from a company's CA-cert and then be able to find out who signed the image? It ...
Nyarmith's user avatar
  • 101
3 votes
2 answers
2k views

How do I expire users credentials for Kubernetes in Azure?

I am looking for information on how to forcefully expire users credentials in Azure Kubernetes Service (AKS). The reason is to better understand Security models and protecting Kubernetes deployments ...
Steven K7FAQ's user avatar
3 votes
1 answer
3k views

Accessing TPM from inside a Docker Container

I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked to look ...
7_R3X's user avatar
  • 155
3 votes
2 answers
160 views

Mitigating Maven Central risks as seen from the DevSecOps perspective

AFAIK there are two official primary repositories for Maven packages (Java language): search.maven.org offered by Sonatype Inc. mvnrepository.com offered by a private person @frodriguez Now ...
Ta Mu's user avatar
  • 6,802
3 votes
1 answer
65 views

Is it possible to securely delete a file from a virtual disk in a cloud provider?

Considering that virtual hard drives are generally formatted using something like ext3 that abstracts away from the underlying block device, which in and of itself is an abstraction over the top of a ...
Richard Slater's user avatar
3 votes
1 answer
207 views

Provide customers with access to Azure Container Registry

I'm using Azure Container Registry for private Docker images. I want to let around 500 customers pull images and use the Docker V2 HTTP API to read metadata. Service Principals are one way to go ...
Cocowalla's user avatar
  • 153
3 votes
0 answers
246 views

Encrypted at rest persistent volume in kubernetes? [closed]

Is there a recommended approach to using encrypted file system for persistent volumes in kubernetes? Perhaps mounting a LUKS fs disk image file ?
barrymac's user avatar
  • 257
3 votes
1 answer
3k views

Docker Security Scanning: How to integrate Clair with a docker private registry?

According to the following documentation it should be possible to integrate clair with a docker private registry. How to do that? Registry Integration Clair can be integrated directly into a ...
030's user avatar
  • 13.1k
2 votes
1 answer
490 views

Should I turn off copilot for text files containing secrets?

I use VSCode and have recently started using GitHub Copilot for my projects (programming and devops related). I understand that Copilot will send parts of my text to a remote server to get suggestions ...
cherouvim's user avatar
  • 121
2 votes
1 answer
504 views

Azure Security Center with Ubuntu 19

Has anyone successfully gotten the Azure Security Center agent to work with Ubuntu 19? My omsconfig.log is full of messages like This event indicates that failure happens when LCM is trying to get ...
Gaius's user avatar
  • 1,086
2 votes
1 answer
7k views

How can you pass private environment variables to FARGATE tasks specified from a Docker Compose config

I am using an existing docker-compose.yml to migrate an app to ECS. The config references several $ENV vars which I used to pass in simply as environment variables when running docker-compose up. One ...
scipilot's user avatar
  • 249
2 votes
1 answer
801 views

Context of DevOps in ISO 27001 security audits

Correct me if I am wrong, ISO 27001 addresses mostly organizational and operational aspects. This sounds a little bit abstract and regulatory. On the other hand, in DevOps, if you wish DevSecOps, ...
Ta Mu's user avatar
  • 6,802
2 votes
1 answer
262 views

Sharing Gems between Chef and System Ruby

I know about the chef_gem resource obv, but in the interests of good system hygiene I would like to avoid as much as possible duplication, so I would like to share Gems between the embedded Ruby ...
Gaius's user avatar
  • 1,086
2 votes
1 answer
64 views

Continuous deployment strategies vs DevSecOps

How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here? Security requirements may differ, let's assume this simple level of ...
Ta Mu's user avatar
  • 6,802
2 votes
1 answer
116 views

What are the best practices for sharing production Postgres access with developers?

We're a small SaaS startup (~10 person team; mostly engineers). We use Postgres on AWS and GCP in production. We have signed contracts with some customers that prohibit us from giving full production ...
RainSear's user avatar
  • 121
2 votes
1 answer
75 views

How to protect secrets whilst enabling the ability to amend a pipeline

I'm writing a CI pipeline using GitHub Actions. The pipeline will build a Docker image, which it will then push to our Docker repository (AWS ECR). In order to talk to ECR, we'll need to provide a ...
JohnLBevan's user avatar
2 votes
1 answer
60 views

Company is worried about exposing our PII to Tableau, Can we run Tableau without exposing our data to any 3rd parties?

I'm looking to understand a bit more from the technical side about how Tableau (The company itself) works with the data that everyone is providing them. My company is looking to use Tableau as our ...
user avatar
2 votes
1 answer
108 views

How to verify hashes of Ansible Galaxy dependencies?

From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks. This is the best ...
Philipp Claßen's user avatar
2 votes
1 answer
86 views

Restrict user logon in Jenkins

We have been using groovy script to read the build queue state: def builder = new groovy.json.JsonBuilder() builder { queueItems(Jenkins.instance.queue.items.collect { obj -> [ id:...
Skyblade's user avatar
  • 123
2 votes
1 answer
54 views

Bad practice having a single SSH gateway with access to all environments?

I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server. My question is, should I create a separate SSH gateway server for each ...
MrScripter's user avatar
2 votes
2 answers
132 views

How do you know which secrets and credentials of your production services were used, and by whom/what?

The context of the question is Secrets management. As the title says, how do you know which secrets and credentials of your production services were used, and by whom/what?
Zvika Nadav's user avatar
2 votes
1 answer
618 views

Issue integrating acunetix with jenkins

The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My ...
4LB3R70's user avatar
  • 21
2 votes
1 answer
914 views

Real-World Validating the Integrity of a Docker Container

I'm interested in information and experiences surrounding Docker security. I'd like to understand ways that a user/client could validate the contents of an image to ensure that the packaged ...
Glenak1911's user avatar
2 votes
0 answers
97 views

What security loopholes does Istio tackle?

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
Pasan W.'s user avatar
  • 203