Back to DevOps & SRE

Module 7: Security & Compliance

Integrate security into every stage of the DevOps lifecycle with DevSecOps practices and automation

🔒 DevSecOps: Shift Left Security

DevSecOps integrates security practices into the DevOps process. Instead of security being a gate at the end, it's built into every stage from development to production.

Shift Left Philosophy

"Shift left" means moving security earlier in the development lifecycle. Finding vulnerabilities in development is 100x cheaper than finding them in production.

❌ Traditional→ Code → Build → Test → Security Scan → Deploy
✅ DevSecOps→ Secure Code → Scan → Build → Test → Scan → Deploy → Monitor

Security in CI/CD Pipeline

Code Analysis (SAST)

Static analysis of source code for vulnerabilities

Dependency Scanning (SCA)

Check third-party libraries for known vulnerabilities

Container Scanning

Scan Docker images for vulnerabilities

Dynamic Testing (DAST)

Test running applications for security issues

Infrastructure Scanning

Check IaC for misconfigurations

🔐 Automated Security Pipeline

Integrate security tools into your CI/CD pipeline to catch issues automatically before they reach production.

GitHub Actions Security Pipeline

name: Security Pipeline

on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # SAST - Static code analysis
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: auto
      
      # SCA - Dependency scanning
      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high
      
      # Secret scanning
      - name: TruffleHog Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD
      
      # Container scanning
      - name: Build Docker image
        run: docker build -t myapp:latest .
      
      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:latest
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      # Upload results
      - name: Upload to GitHub Security
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
      
      # IaC scanning
      - name: Scan Terraform
        uses: aquasecurity/tfsec-action@v1.0.0
        with:
          soft_fail: false

Container Security Best Practices

Secure Dockerfile

# Use specific version, not 'latest'
FROM node:20.10-alpine

# Run as non-root user
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nodejs -u 1001

# Set working directory
WORKDIR /app

# Copy only necessary files
COPY package*.json ./
RUN npm ci --only=production

COPY --chown=nodejs:nodejs . .

# Drop privileges
USER nodejs

# Expose port
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=3s \
  CMD node healthcheck.js

CMD ["node", "server.js"]

Image Scanning

Scan images for:

  • • Known CVEs in base images
  • • Vulnerable dependencies
  • • Malware and secrets
  • • Configuration issues

🔑 Secrets Management

Never store secrets in code or environment variables. Use dedicated secrets management tools to securely store, access, and rotate credentials.

HashiCorp Vault

# Store secret in Vault
vault kv put secret/myapp/db \
  username="dbuser" \
  password="secure-password"

# Read secret
vault kv get secret/myapp/db

# Application code (Node.js)
const vault = require('node-vault')({
  endpoint: process.env.VAULT_ADDR,
  token: process.env.VAULT_TOKEN
});

async function getDbCredentials() {
  const result = await vault.read('secret/data/myapp/db');
  return result.data.data;
}

// Use dynamic secrets (auto-rotate)
const dbCreds = await vault.read('database/creds/myapp-role');
// Credentials are temporary and auto-expire

Kubernetes Secrets with External Secrets Operator

# ExternalSecret syncs from Vault to K8s Secret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: myapp-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: myapp-secrets
    creationPolicy: Owner
  data:
    - secretKey: db-password
      remoteRef:
        key: secret/myapp/db
        property: password

---
# Use in Pod
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: app
    image: myapp:latest
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: myapp-secrets
          key: db-password

⚠️ Secrets Best Practices:

  • ✓ Never commit secrets to Git
  • ✓ Use secret scanning tools (TruffleHog, GitGuardian)
  • ✓ Rotate secrets regularly
  • ✓ Use short-lived credentials when possible
  • ✓ Encrypt secrets at rest and in transit
  • ✓ Audit secret access
  • ✓ Principle of least privilege

📋 Compliance as Code

Compliance as Code automates security and compliance checks. Define policies as code and enforce them automatically in your pipelines.

Open Policy Agent (OPA)

# policy.rego - Kubernetes admission policy
package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  image := input.request.object.spec.containers[_].image
  not startswith(image, "myregistry.com/")
  msg := sprintf("Image %v is not from approved registry", [image])
}

deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  not container.securityContext.runAsNonRoot
  msg := sprintf("Container %v must run as non-root", [container.name])
}

deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  container.securityContext.privileged
  msg := sprintf("Container %v cannot run in privileged mode", [container.name])
}

Policy Enforcement Points

CI/CD Pipeline

Block builds that violate policies

Kubernetes Admission

Reject non-compliant resources

Terraform Plan

Validate IaC before apply

Runtime

Monitor and alert on violations

🌐 Network Security

Kubernetes Network Policies

# Default deny all ingress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

---
# Allow specific traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432

Service Mesh Security (Istio)

Istio provides:

  • • Automatic mTLS between services
  • • Fine-grained authorization policies
  • • Traffic encryption
  • • Certificate management
  • • Request authentication (JWT)

👁️ Security Monitoring & Incident Response

What to Monitor

Application Security:

  • • Failed authentication attempts
  • • Unusual API access patterns
  • • SQL injection attempts
  • • XSS attack attempts

Infrastructure Security:

  • • Unauthorized access attempts
  • • Privilege escalation
  • • Unusual network traffic
  • • Configuration changes

Security Incident Response

1. Detect & Alert

Security monitoring tools detect anomaly and trigger alert

2. Contain

Isolate affected systems, revoke compromised credentials

3. Investigate

Analyze logs, determine scope and impact

4. Remediate

Patch vulnerabilities, restore from clean backups

5. Learn

Post-incident review, update security controls

📝 Module Summary

You've learned comprehensive DevSecOps practices:

Security Practices:

  • ✓ Shift-left security
  • ✓ Automated security scanning
  • ✓ Container security
  • ✓ Secrets management

Compliance & Monitoring:

  • ✓ Policy as code
  • ✓ Network security
  • ✓ Security monitoring
  • ✓ Incident response

🎉 Congratulations!

You've completed the DevOps & Site Reliability Engineering course! You now have the skills to build, deploy, monitor, and maintain reliable, secure, scalable systems.

What You've Mastered:

Technical Skills:

  • ✓ CI/CD pipelines
  • ✓ Container orchestration
  • ✓ Infrastructure as Code
  • ✓ Monitoring & observability

SRE Practices:

  • ✓ Incident management
  • ✓ Capacity planning
  • ✓ Chaos engineering
  • ✓ Security automation