29 votes
Accepted

How can I manage secrets in .tf and .tfstate?

Terraform supports adding an additional file with variables during invocation. documentation: https://www.terraform.io/intro/getting-started/variables.html#from-a-file We are using that feature to ...
user avatar
24 votes
Accepted

What are best and comprehensive practices to consider when running docker in production?

The host on which the containers are running Run the docker security bench on every node that runs docker containers https://github.com/docker/docker-bench-security Running the following command on ...
user avatar
  • 12.5k
17 votes

How to prohibit access to internals of Docker container?

In short, you cannot prevent your customers from modifying containers they run in their own infrastructure. Containers are not like binaries that can be obfuscated; they are runtime environments. ...
user avatar
  • 3,943
17 votes
Accepted

What Is SecOps?

I'd agree this is a buzzword as much as DevOps can be. Main task of a SecOps added on top of an usual operational engineer tasks is to take the burden of following CVE publication feeds, handling the ...
user avatar
  • 11k
15 votes
Accepted

Where to put ansible-vault password

The idea is to put all our sensitive data [...] The meaning of "all" in this sentence should be analyzed very carefully before implementing the solution that you plan. Ansible vault is a very useful ...
user avatar
10 votes

How can I manage secrets in .tf and .tfstate?

If you're on AWS, then have a look at "The Right Way to Manage Secrets" by Segment.io on the AWS Blog. We advocate using chamber to all of our customers for managing secrets. It works by leveraging ...
user avatar
9 votes

How to prohibit access to internals of Docker container?

Docker doesn't provide any means to preclude user access to the container, however as the image developer you could follow a few strategy Obfuscate your software (ruby, python and etc) Build your ...
user avatar
  • 426
9 votes

Where to put ansible-vault password

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. Since you haven't yet implemented anything, you might reconsider this. Using a system like Ansible ...
user avatar
8 votes

What Is SecOps?

I do agree with Tensibai's Answer in that SecOps is as much as a buzz-word as DevOps itself and that SecOps is a stepping stone between a siloed organisation and cohesive organisation. I have ...
user avatar
8 votes

How can I manage secrets in .tf and .tfstate?

We avoid terraform handle our secrets. Even if you manage to inject secrets by a var file "secrtes.tfvars" as pointed out above, these secrets will be stored in your terraform (remote-)state. You can ...
user avatar
  • 141
8 votes

What are best and comprehensive practices to consider when running docker in production?

Docker images itself An additional option is to use Clair. Clair is an open source project for the static analysis of vulnerabilities in application containers (currently including appc and ...
user avatar
  • 12.5k
8 votes

What are best and comprehensive practices to consider when running docker in production?

In addition to the points in this thread; the following would be my recommendation: Get control over Docker PID1 with dumb-init ref: PID1 and Zombie reaping problem Do not run docker in production ...
user avatar
  • 441
7 votes

What are best and comprehensive practices to consider when running docker in production?

Docker is still in development. As with every other software in-dev bugs will happen, insecure features might be added, there could be architectural flaws that lead to security breaches. Do not ...
user avatar
  • 171
7 votes
Accepted

How to store credentials that are required by an application?

Proper management of an application's secrets has always been a challenge. New challenges came with the adoption of the cloud. There's a great OWASP presentation about the reality and challenges of ...
user avatar
  • 1,925
7 votes
Accepted

How to storing encrypted secrets in code for a serverless.com project?

There are a couple of elements to consider here: It is valuable to have the capability to maintain configuration with a separate release cadence from the code that is being configured. Doing so ...
user avatar
7 votes
Accepted

Running the docker daemon without root

Compared to just adding the user to the docker group the second links solution is not any more secure. Note how that page still can launch with the --privileged flag, and that it is running ...
user avatar
  • 366
7 votes

Is it bad to use sudo from Jenkins?

Whether you allow remote sudo or remote access to something that does SUID root you have a pretty similar attack surface. I would keep sudo in the chain because it lets you limit the commands easily ...
user avatar
  • 1,728
7 votes
Accepted

What are the best practices for anti-virus / anti-malware when using containers?

This is an area where you will need to talk directly to and potentially help educate your auditors. What you have to remember is they are responsible for ensuring that adequate controls are applied, ...
user avatar
6 votes
Accepted

How to only allow API Gateway requests to reach our EC2 instances

Since November 2017, it is now possible to directly interact with servers in a VPC \o/ See: https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-...
user avatar
6 votes

How to prohibit access to internals of Docker container?

If your client is ready to invest money then you should go with Docker enterprise edition. In Docker EE you have one tool that is UCP(Universal Control Plane) UCP. By UCP you can create roles and ...
user avatar
6 votes
Accepted

Is it bad to use sudo from Jenkins?

No, it's actually really good security practice to sudo when you need higher level privileges. This is the reason that most distributions prohibit default login and actually force you to sudo su ...
user avatar
  • 3,655
6 votes
Accepted

From a security perspective, to which location should one copy an app inside a docker image?

I don't see a point. An external attacker (who has access to the host) can easily find where the files are - he only has to look at the last file system layer and will have them presented right there ...
user avatar
  • 4,696
5 votes

Open Ports on Google Cloud Load Balancer

You can't add deny rules to GC firewall. The default policy is Deny. You can only add allow rules - allow everything you need and let everything else get rejected. Since the ports you need to block ...
user avatar
  • 749
5 votes

How to prohibit access to internals of Docker container?

You can remove the users from the docker group and create sudos for the docker start and docker stop.
user avatar
5 votes

Where to put ansible-vault password

This quite much goes to what internal policies you have on handling sensitive data. I'd like to tell you my approach to this and explain what I see as pros and cons. I keep the Ansible Vault ...
user avatar
  • 749
5 votes
Accepted

When your micro service in production needs a secret, where is the secret stored and retrieved from?

Short answer Ideally, you should store secrets as environment variables, and retrieve them from a secrets management system like Hashicorp's Vault or AWS Parameter store. Long answer I saw your ...
user avatar
  • 1,322
4 votes

Open Ports on Google Cloud Load Balancer

info from: https://cloud.google.com/load-balancing/docs/https#open_ports Open ports The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming ...
user avatar
4 votes

Open Ports on Google Cloud Load Balancer

It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB. This is a feature request. https://issuetracker.google.com/issues/35904903
user avatar
  • 189
4 votes

Open Ports on Google Cloud Load Balancer

I looked for that too but I don't think you can as these are the ports used by Google to do LB: HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced ...
user avatar
  • 141
4 votes
Accepted

What strategies can be employed to secure sensitive data in log files?

I think the solution comes down to a broad spectrum of approaches that ensures data protection: Data Classification: The most efficient technical strategy is to categorise the data at the point of ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible