DevSecOps — Shift Left Security

1. Vì sao DevSecOps?

Truyền thống: Security là phase cuối — Pen-tester scan trước release, log bug, dev fix sau. Vấn đề:

• Bug security phát hiện muộn → cost fix cao 100×.
• Pentest 2 tuần/release → bottleneck.
• Dev không học từ bug security.
• Compliance audit = rush 2 tuần trước.

DevSecOps: tích hợp security vào mọi giai đoạn DevOps lifecycle.

1.1. Cost of late security

Source: NIST. Bug security có production = patch + incident response + customer notification + audit.

1.2. Recent breaches

• SolarWinds 2020 — supply chain attack, 18,000 organizations affected.
• Log4Shell 2021 — RCE qua dependency, internet meltdown.
• Codecov 2021 — bash uploader compromise → leak credentials of 100s companies.
• 3CX 2023 — supply chain double-tier attack.
• XZ Utils 2024 — multi-year backdoor in critical OSS lib (caught early).

Common pattern: supply chain. Bạn không phải target chính — attacker compromise dependency bạn dùng.

1.3. DevSecOps principles

1. Shift-left — phát hiện sớm trong pipeline.
2. Automate — security check là code, không manual.
3. Defense in depth — nhiều layer (network + app + data).
4. Least privilege — IAM, RBAC, network policy.
5. Zero trust — không trust gì mặc định.
6. Continuous — security không phải project, là practice.
7. Shared responsibility — dev + security cùng own.

2. Shift-Left Security — Pipeline Integration

2.1. CI security pipeline example

# .github/workflows/security.yml
name: Security

on: [pull_request, push]

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: gitleaks/gitleaks-action@v2

  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: npm audit --audit-level=high
      - uses: snyk/actions/node@master
        env: { SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} }

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: p/owasp-top-ten

  iac-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: config
          severity: HIGH,CRITICAL
          exit-code: 1

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t myapp:${{ github.sha }} .
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          severity: CRITICAL
          exit-code: 1

3. SAST — Static Application Security Testing

Analyze source code (không run) để tìm vulnerability pattern.

3.1. Tools

3.2. Semgrep example

# Run với rules có sẵn
semgrep --config p/security-audit .
semgrep --config p/owasp-top-ten .
semgrep --config p/javascript .

# Custom rule
cat > rules/sql-injection.yml <<EOF
rules:
  - id: sql-injection
    pattern: |
      query = "SELECT * FROM users WHERE id = " + \$X
    message: "SQL injection risk: don't concatenate user input"
    severity: ERROR
    languages: [python, javascript]
EOF

semgrep --config rules/ .

3.3. Vulnerability classes

• Injection — SQL, command, LDAP injection.
• XSS — Cross-site scripting.
• Insecure crypto — MD5, SHA1, ECB, hardcoded key.
• Path traversal — ../ file access.
• SSRF — Server-Side Request Forgery.
• XXE — XML External Entity.
• Insecure deserialization.

Reference: OWASP Top 10.

3.4. Suppress false positive

// Semgrep nosemgrep
const html = userInput; // nosemgrep: javascript.lang.security.audit.unsafe-html

// Justification COMMENT cần thiết — không bypass blindly

Track suppression — quarterly review.

4. DAST — Dynamic Application Security Testing

Test running app (black box) — gửi malicious request, observe response.

4.1. Tools

• OWASP ZAP — open source, GUI + CLI.
• Burp Suite — paid, popular pentest tool.
• Nuclei — template-based scanner.
• nikto — web server scanner.
• sqlmap — SQL injection specialist.

4.2. ZAP trong CI

- name: ZAP baseline scan
  uses: zaproxy/action-baseline@v0.10.0
  with:
    target: 'https://staging.example.com'
    rules_file_name: '.zap/rules.tsv'
    cmd_options: '-a'

4.3. SAST vs DAST so sánh

Use both — complement.

4.4. IAST — middle ground

Interactive Application Security Testing: agent trong runtime, observe code execution + input. Best of both. Tools: Contrast, Veracode IAST.

5. SCA — Software Composition Analysis

Modern app = 90%+ third-party dependency. SCA scan dependency cho known vulnerabilities (CVE).

5.1. Tools

• npm audit, yarn audit, pnpm audit (Node).
• pip-audit, safety (Python).
• bundle audit (Ruby).
• govulncheck (Go).
• Snyk — multi-language, IDE + CLI + CI.
• Dependabot (GitHub) — auto PR upgrade.
• Renovate — alternative, customizable.
• OWASP Dependency-Check.
• Trivy — multi-purpose (container + SCA + IaC).

5.2. Dependabot config

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    versioning-strategy: increase
    groups:
      eslint:
        patterns: ["eslint*"]
      typescript:
        patterns: ["typescript", "@types/*"]

  - package-ecosystem: docker
    directory: /
    schedule:
      interval: weekly

  - package-ecosystem: terraform
    directory: /infra
    schedule:
      interval: weekly

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly

5.3. Vulnerability severity

5.4. Reachability analysis

1 dependency có CVE không = bạn vulnerable. Cần check: code có thực sự call vulnerable function không?

Tools: Snyk Reachability, Endor Labs — reduce noise hiệu quả 70-90%.

5.5. License compliance

Một số license (GPL, AGPL) yêu cầu open source code dùng nó. Vi phạm = legal issue.

Tools: FOSSA, BlackDuck, Snyk License, license-checker (npm).

Whitelist phổ biến cho proprietary: MIT, Apache-2.0, BSD-3-Clause, ISC.

6. Secret Scanning

6.1. Tools

• gitleaks — fast, popular.
• trufflehog — entropy + verifier.
• detect-secrets (Yelp).
• GitHub Secret Scanning — built-in.
• GitGuardian — SaaS, real-time scan.

6.2. gitleaks pre-commit

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/zricethezav/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

# CLI
gitleaks detect --source . --verbose
gitleaks detect --source . --report-format json --report-path leaks.json

# Scan git history
gitleaks detect --source . --no-banner --no-color

6.3. GitHub Secret Scanning

Free for public repos, paid Advanced Security cho private. Pattern detection cho 100+ provider (AWS, Stripe, Slack, ...). Push protection: block commit chứa secret known pattern.

6.4. Khi secret leak

1. Rotate ngay — invalidate secret, generate new.
2. Audit log — check secret used từ đâu, có suspicious?
3. Rewrite history (optional, drastic) — BFG Repo-Cleaner / git-filter-repo. Lưu ý: break clones, force push.
4. Postmortem.
5. Improve process — add pre-commit hook, training.

7. Container Security

7.1. Image scanning — Trivy

trivy image myapp:1.0
trivy image --severity HIGH,CRITICAL myapp:1.0

# Fail CI if critical
trivy image --exit-code 1 --severity CRITICAL myapp:1.0

# Scan k8s YAML
trivy config k8s/

# Scan Dockerfile
trivy config Dockerfile

# Multi-purpose
trivy fs .
trivy repo https://github.com/...

7.2. Reduce attack surface

1. Minimal base image — distroless, alpine.
2. Multi-stage build — runtime image không có compiler/devDep.
3. Non-root user.
4. Read-only filesystem.
5. Drop all capabilities, add chỉ cần thiết.
6. No SSH trong container.
7. Pin base image SHA.

7.3. Pod Security Standards (K8s)

K8s 1.25+ deprecate PodSecurityPolicy, replace bằng PSS:

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest

7.4. Admission controllers

• Pod Security Admission — built-in.
• OPA Gatekeeper — generic policy.
• Kyverno — Kubernetes-native, no Rego.

7.5. Network policy zero-trust

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

# Sau đó allow specific
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow
spec:
  podSelector:
    matchLabels: { app: api }
  ingress:
    - from:
        - podSelector:
            matchLabels: { app: web }
      ports:
        - port: 3000
  egress:
    - to:
        - podSelector:
            matchLabels: { app: db }
      ports:
        - port: 5432
    - to:
        - namespaceSelector:
            matchLabels: { name: kube-system }
      ports:
        - port: 53                         # DNS

Cần CNI hỗ trợ (Calico, Cilium). Default K8s allow-all.

8. Supply Chain Security

Sau SolarWinds, Log4Shell, XZ — supply chain trở thành priority security.

8.1. SBOM — Software Bill of Materials

SBOM = list mọi component (lib, version, license) trong artifact. Format: SPDX hoặc CycloneDX.

# Generate SBOM với syft
syft myapp:1.0 -o cyclonedx-json > sbom.json
syft myapp:1.0 -o spdx-json > sbom.spdx.json

# Check SBOM cho known vuln với grype
grype sbom:./sbom.json

US Executive Order 14028 (2021) require SBOM cho federal contracts.

8.2. Sign artifact — Sigstore / cosign

# Keyless signing với OIDC (no key management!)
cosign sign --yes ghcr.io/me/myapp:1.0

# Verify
cosign verify --certificate-identity me@example.com \
  --certificate-oidc-issuer https://github.com/login/oauth \
  ghcr.io/me/myapp:1.0

Sigstore (CNCF) là free signing infrastructure. Identity-based, không cần PKI.

8.3. Verify trong K8s

# Kyverno policy verify image signature
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-signature
      match:
        any:
          - resources:
              kinds: [Pod]
      verifyImages:
        - imageReferences:
            - "ghcr.io/me/*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/me/myrepo/.github/workflows/*"
                    issuer: "https://token.actions.githubusercontent.com"

8.4. SLSA — Supply chain Levels for Software Artifacts

Framework Google define 4 levels supply chain integrity:

8.5. Provenance attestation

# Sigstore attest provenance
cosign attest --predicate provenance.json --type slsaprovenance \
  ghcr.io/me/myapp:1.0

Provenance = "ai build, từ commit nào, với build steps gì". Verify trước deploy.

9. Policy as Code

9.1. OPA (Open Policy Agent)

Generic policy engine. Policy viết bằng Rego:

package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  input.request.object.spec.containers[_].securityContext.runAsUser == 0
  msg := "Pod must not run as root"
}

deny[msg] {
  input.request.kind.kind == "Pod"
  not input.request.object.spec.containers[_].resources.limits.memory
  msg := "Memory limit required"
}

deny[msg] {
  input.request.kind.kind == "Service"
  input.request.object.spec.type == "LoadBalancer"
  not contains(input.request.object.metadata.annotations["service.beta.kubernetes.io/aws-load-balancer-internal"], "true")
  msg := "Public LoadBalancer not allowed; use ingress"
}

Use cases: K8s admission, Terraform validation, API authorization.

9.2. Conftest — OPA cho IaC

# Test Terraform plan
terraform plan -out=plan.binary
terraform show -json plan.binary > plan.json
conftest test plan.json --policy ./policy/

# Test K8s YAML
conftest test deployment.yaml --policy ./policy/

9.3. Kyverno — K8s native

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resources
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-resources
      match:
        any:
          - resources:
              kinds: [Pod]
      validate:
        message: "Both resources requests and limits required"
        pattern:
          spec:
            containers:
              - name: "*"
                resources:
                  limits:
                    memory: "?*"
                    cpu: "?*"
                  requests:
                    memory: "?*"
                    cpu: "?*"

Kyverno đơn giản hơn OPA (YAML pattern matching, no Rego). Đa số K8s policy use cases.

10. Runtime Security

SAST/DAST/SCA detect static. Runtime security detect attack đang xảy ra.

10.1. Falco

Falco (CNCF) detect anomalous syscall/file/network activity:

# Falco rule
- rule: Suspicious shell in container
  desc: Detect shell spawned in production container
  condition: spawned_process and container and shell_procs
  output: Shell spawned (user=%user.name container=%container.id command=%proc.cmdline)
  priority: WARNING

- rule: Write to /etc
  desc: Process writing to /etc directory
  condition: open_write and fd.directory startswith /etc
  output: Write to /etc (user=%user.name path=%fd.name)
  priority: ERROR

Sử dụng eBPF kernel hooks — minimal overhead, see syscalls.

10.2. Cilium Tetragon

Modern alternative — eBPF-based, Kubernetes-native. Detect + enforce (block syscall).

10.3. AWS GuardDuty / GCP Security Command Center / Azure Defender

Cloud-native threat detection: VPC flow log analysis, malicious IP detection, instance behavior anomaly. Easy enable, recommend cho cloud workload.

10.4. RASP — Runtime Application Self-Protection

Agent trong app process, detect + block attack tại app layer (SQL injection ngay trước query, ...). Tools: Contrast, Imperva.

11. Compliance

11.1. Common standards

11.2. Compliance as Code

Audit chỉ ngắn gọn nếu đã có evidence trong toolchain:

• Access control → IAM policy + audit log.
• Encryption → Terraform code force encryption.
• Backup → automated với retention.
• Vulnerability mgmt → CVE scan trong CI.
• Incident response → runbook + postmortem.
• Change management → Git PR + approval.

Tools auto-collect evidence: Drata, Vanta, SecureFrame.

11.3. Audit log

Cloud-native audit:

• AWS CloudTrail — all API calls.
• GCP Cloud Audit Logs.
• Azure Activity Log.
• K8s audit policy → log API server requests.
• App-level audit (login, action) → structured log.

Retention: 90 days hot, 1+ year cold (per compliance requirement).

12. Threat Modeling

12.1. STRIDE

Microsoft STRIDE — categorize threats:

12.2. Process

1. Decompose application — components, data flow, trust boundary.
2. Identify threats — apply STRIDE per component.
3. Rate threats — DREAD (Damage, Reproducibility, Exploitability, Affected, Discoverability).
4. Mitigate — design controls.
5. Document + review.

12.3. Khi nào threat model?

• New service / major architecture change.
• Handle sensitive data (PII, payment).
• External-facing API.
• Compliance requirement.

Tools: Microsoft Threat Modeling Tool, OWASP Threat Dragon, Threagile.

13. Bài tập

1. Pre-commit security: setup gitleaks + detect-secrets trong pre-commit. Cố tình commit AWS key, verify hook block.
2. SAST trong CI: add Semgrep với p/owasp-top-ten. Fix top 5 findings.
3. SCA + Dependabot: setup Dependabot config cho npm + docker + terraform. Review PRs hàng tuần.
4. Container scan: Trivy scan image. Identify CRITICAL CVE. Fix bằng upgrade base image.
5. SBOM: generate SBOM với syft cho 1 image. Inspect format CycloneDX. Run grype trên SBOM.
6. cosign sign + verify: sign image với cosign keyless (OIDC GitHub). Verify identity. Setup Kyverno policy require signature.
7. Pod Security Standards: label namespace với pod-security.kubernetes.io/enforce: restricted. Try deploy Pod chạy as root, verify rejected.
8. Network Policy: implement zero-trust trong namespace: default-deny + explicit allow. Verify Pod không reach Pod khác trừ khi allow.
9. OPA / Kyverno: viết policy require resource.limits cho mọi Pod. Test với deployment thiếu limit, verify rejected.
10. Falco: cài Falco trên cluster. Trigger rule "Suspicious shell" bằng kubectl exec -it pod -- bash. Verify alert.
11. Threat model: cho 1 service bạn maintain. Decompose. Apply STRIDE. List 5 threats + mitigations.
12. Compliance audit: cho organization, audit theo CIS Benchmarks K8s. Identify top 5 gaps. Plan remediation.
13. Secret rotation drill: simulate AWS key leak. Practice: rotate key, audit CloudTrail, postmortem.
14. SLSA assessment: đánh giá build pipeline hiện tại theo SLSA levels. Plan upgrade từ L1 lên L3.

14. Quiz