⚙️ DevSecOps Arsenal ⚙️

Welcome to the DevSecOps Arsenal — a comprehensive, curated collection of tools, methodologies, and resources to seamlessly integrate security into every stage of your SDLC and DevOps workflows.

DevSecOps_HaimCohen For interactive interface click here

📜 Table of Contents

Section	Description
What is DevSecOps? 🤔	Understanding the integration of security into the DevOps lifecycle.
What is SDLC and SSDLC? 🔍	Overview of SDLC and SSDLC practices.
Shift-Left SSDLC 🔄	Moving security and QA earlier in the development lifecycle.
Tooling 🛠️	A curated list of DevSecOps tools categorized by use case.
Methodologies, Whitepapers, and Architecture 📚	Resources to deepen understanding of DevSecOps.
Contribution Rules 🤝	Guidelines for contributing to the DevSecOps Arsenal.

🤔 What is DevSecOps?

DevSecOps ensures security is integrated at every phase of the DevOps lifecycle—planning, coding, building, testing, releasing, deploying, operating, and monitoring. It emphasizes automation, collaboration, and enforcement to bridge development, security, and operations. Learn more:

RedHat DevSecOps
IBM DevSecOps
Standard DevSecOps Platform Framework
OWASP DevSecOps Guideline - Comprehensive guidelines for implementing secure pipelines and promoting shift-left security culture in development processes.

🔍 What is SDLC and SSDLC?

Software Development Life Cycle (SDLC)

The SDLC is a framework that defines the processes and phases involved in software development, including:

Planning 📝
Analysis 📊
Design 🎨
Implementation 💻
Testing 🧪
Deployment 🚀
Maintenance 🔄

Secure Software Development Life Cycle (SSDLC)

SSDLC integrates security practices into each phase of the SDLC. It ensures vulnerabilities are addressed early, reducing risks and costs. Key practices include:

Threat Modeling during planning and design.
Static Analysis during development.
Dynamic Testing before deployment.

How They Work Together

The SSDLC augments the SDLC by embedding security checks at every stage. This alignment ensures that security becomes a fundamental part of the development process rather than an afterthought, fostering secure and high-quality software.

🔄 Shift-Left SSDLC

Concept

Shift-Left SSDLC refers to integrating security and quality assurance (QA) earlier in the software development process—shifting activities typically done later, such as testing and security checks, to earlier phases like planning and coding.

Significance

By addressing issues earlier:

Cost savings: Fixing vulnerabilities in the design phase is cheaper than post-deployment.
Improved software quality: Early detection enhances the overall reliability and security of the software.
Faster delivery: Reduced rework shortens development cycles.

Methodologies and Best Practices

Early Threat Modeling: Incorporate tools like ThreatSpec to identify potential risks during planning.
Pre-Commit Hooks: Use tools like Git-Secrets to prevent sensitive data from being committed.
Static Code Analysis: Implement tools like Semgrep during development.
Collaborative Development: Foster teamwork between developers, QA, and security teams.
Continuous Feedback Loops: Use CI/CD pipelines to automate testing and provide feedback.

🛠️ Tooling

Category	Tool Name & Description	GitHub Stars
Pre-Commit Time Tools ⚡	Git-Secrets: Detects secrets in commits.
	SonarLint: IDE-based tool for real-time code quality checks.
	ThreatSpec: Threat modeling as code for early risk identification.
	Gitleaks: Detect and prevent hardcoded secrets like passwords, api keys, and tokens in git repos.
	pre-commit: Framework for managing and maintaining git pre-commit hooks.
Secrets Management 🔒	TruffleHog: Scans repositories for secrets.
	HashiCorp Vault: Provides secure access and storage for secrets.
	Mozilla SOPS: Encrypts secrets in YAML and JSON files.
	AWS Secrets Manager: Securely store and manage secrets in AWS.
	Sealed Secrets: Kubernetes controller for one-way encrypted secrets.
OSS Dependency Management 📦	Snyk: Identifies and fixes vulnerabilities in dependencies.
	CycloneDX: Creates software BOMs (Bill of Materials) for tracking dependencies.
	Dependabot: Automated dependency updates and security alerts.
	Renovate: Automated dependency updates with flexible configuration.
Supply Chain Security 🔗	Tekton Chains: Provides Kubernetes-native supply chain security.
	SLSA Framework: Offers standards for supply-chain security.
	Sigstore: Tools for signing, verifying and protecting software.
	in-toto: Framework to secure the integrity of software supply chains.
SAST 🛡️	Semgrep: High-quality static analysis.
	Bandit: Python-specific security linter.
	SonarQube: Continuous code quality and security analysis.
	CodeQL: Semantic code analysis engine for security vulnerabilities.
DAST 🌐	OWASP ZAP: Dynamic scanner for web vulnerabilities.
	Nuclei: Template-based vulnerability scanning.
	Burp Suite: Web application security testing platform.	-
	Acunetix: Automated web vulnerability scanner.	-
	Darkmoon: Open source autonomous penetration testing platform where 50 specialist agents over MCP drive 50+ offensive tools across web, API, Active Directory, Kubernetes and cloud with reproducible proof of exploitation.
Continuous Deployment 🚀	Trivy: Scans containers and configurations for vulnerabilities.
	Terrascan: Static analysis for Infrastructure as Code.
	StackStorm: Automation platform for DevSecOps workflows.
	Anchore: Container image scanning and policy enforcement.
	Clair: Vulnerability static analysis for containers.
Kubernetes Security 🌀	Kubescape: Kubernetes compliance and hardening scanner.
	Kube-Bench: Benchmarks Kubernetes clusters against CIS standards.
	Kyverno: Kubernetes native policy management.
Cloud Security & Compliance 🏛️	Prowler: Open-source CSPM that automates security and compliance across any cloud environment.
	CloudMapper: Visualizes cloud architecture and identifies security risks in AWS environments.
	ScoutSuite: Multi-cloud security auditing tool for AWS, Azure, GCP, and Alibaba Cloud.
Runtime Security & Monitoring 🔍	Wazuh: Open-source SIEM/EDR for runtime threat detection, log analysis, and incident response.
	Falco: Cloud-native runtime security tool for detecting anomalous behavior in real time.
	osquery: SQL-based host monitoring and analytics tool for security visibility.
IaC Security 🏗️	Checkov: Finds misconfigurations in IaC templates.
	KICS: Scans IaC files for vulnerabilities.
	tfsec: Security scanner for Terraform code.
	Snyk IaC: Infrastructure as Code security scanning.
Vulnerability Management	DefectDojo: Platform for centralized vulnerability management.
	ArcherySec: ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec.
	VulnWhisperer: Vulnerability management dashboard.
	VulnIQ: Vulnerability intelligence and management platform.