Add DevSecOps documentation and guidance #436

LizaShak · 2020-12-02T09:27:29Z

Changes introduced in this PR:

Introducing documentation on DevOps Security (DevSecOps) best practices, information and tools for application.
Updating the existing Credential Scanning documentation to follow the same template.
Linking to DevSecOps section in other relevant documentations.

TessFerrandez

Great add to the playbook, very useful content

continuous-integration/dev-sec-ops/secret-management/secrets_rotation.md

...nuous-integration/dev-sec-ops/dependency-container-scanning/dependency_container_scanning.md

DariuszPorowski · 2020-12-17T18:11:23Z

Hey @LizaShak Just started review.

DariuszPorowski

@LizaShak I have only 1 feedback item, aligned with @seushermsft.

continuous-integration/dev-sec-ops/secret-management/secrets_rotation.md

DariuszPorowski

LGTM :)

brockneedscoffee

This is really great content. The Microsoft repo links should probably be removed though since folks who are not part of the Microsoft org cannot access it and this is intended for use outside of Microsoft (e.g. CSE customers, open source community, etc)

brockneedscoffee · 2021-03-18T17:23:15Z

...nuous-integration/dev-sec-ops/dependency-container-scanning/dependency_container_scanning.md

+
+## Dependency and Container Scanning Frameworks and Tools
+
+Use the tools and pipelines as suggested in [CSEDevSecOps Dependency and Container Scanning Scenarios](https://github.com/microsoft/CSEDevSecOps/tree/master/Scenarios/DependencyContainerScanning).


Given this is an open source playbook that we share with our customers and those outside Microsoft I don't think we should include this link. It is not accessible by people who are not part of the Microsoft org, it 404s.

brockneedscoffee · 2021-03-18T17:23:49Z

continuous-integration/dev-sec-ops/penetration-testing/penetration_testing.md

+# Penetration Testing
+
+A penetration test is a simulated attack against your application to check for exploitable security issues.
+For further reading  see [CSEDevSecOps PenetrationTesting Scenarios](https://github.com/microsoft/CSEDevSecOps/tree/master/Scenarios/PenetrationTesting)


Given this is an open source playbook that we share with our customers and those outside Microsoft I don't think we should include this link. It is not accessible by people who are not part of the Microsoft org, it 404s.

brockneedscoffee · 2021-03-18T17:24:26Z

continuous-integration/dev-sec-ops/readme.md

+## The concept of DevSecOps
+
+DevSecOps or DevOps security is about introducing security earlier in the life cycle of application development (a.k.a shift-left), thus minimizing the impact of vulnerabilities and bringing security closer to development team.
+Further information is available [here](https://github.com/microsoft/CSEPackagedSprints/tree/master/DevSecOps).


Given this is an open source playbook that we share with our customers and those outside Microsoft I don't think we should include this link. It is not accessible by people who are not part of the Microsoft org, it 404s.

brockneedscoffee · 2021-03-18T17:24:54Z

continuous-integration/dev-sec-ops/readme.md

+## CSE Packaged Sprints
+
+DevOps, Identity, and Security have standard foundational requirements across Dev Crew projects. The CSE Packaged sprints are set out to tackle this repetitive work. Adding a packaged sprint offers a pathway to dramatically improve the process of incorporating foundational concepts.
+Further information is available [here](https://github.com/microsoft/CSEPackagedSprints).


404s unless you are part of the Microsoft org in GitHub

brockneedscoffee · 2021-03-18T17:25:01Z

continuous-integration/dev-sec-ops/readme.md

+
+## Resources
+
+[CSEDevSecOps Scenarios](https://github.com/microsoft/CSEDevSecOps/tree/master/Scenarios)


404s unless you are part of the Microsoft org in GitHub

brockneedscoffee · 2021-03-18T17:25:17Z

continuous-integration/dev-sec-ops/secret-management/credential_scanning.md

+# Credential Scanning
+
+Credential scanning is the practice of automatically inspecting a project to ensure that no secrets are included in the project's source code. Secrets include database passwords, storage connection strings, admin logins, service principals, etc.
+For further reading see [CSEDevSecOps Credential Scanning Scenarios](https://github.com/microsoft/CSEDevSecOps/tree/master/Scenarios/CredentialScanning).


404s unless you are part of the Microsoft org in GitHub

brockneedscoffee · 2021-04-08T14:11:02Z

@LizaShak is there an update on this? Do you need some assistance?

LizaShak · 2021-04-19T11:29:16Z

@LizaShak is there an update on this? Do you need some assistance?

Hi @brockneedscoffee , we have checked with CSE DevSecOps team to see if those links will be public soon, and they won't in the near two months. So I am currently working on replacing those links with the relevant information.

fnocera · 2021-04-20T18:38:12Z

Once #607 is merged in all outstanding PRs including this one will have to make a few changes and merge master to adopt the new MKDocs structure. This main change is that all the md files move into a docs folder, not on the root of the repo.
If you'd like to test the website locally:

Create a virtual Python env
Install the dependencies ( pip install -r requirements-docs.txt )
Run mkdocs serve

Please don't hesitate to reach out with any questions and a number of us are more than happy to help with this process - reach out to @fnocera @TessFerrandez @omri374 and @brockneedscoffee

LizaShak added 2 commits December 2, 2020 12:53

Add DevSecOps documentation and guidance

6ec5228

Fix lint issues

d43812c

LizaShak force-pushed the feature/dev-sec-ops-docs branch from df97c40 to d43812c Compare December 2, 2020 10:53

Fix lint issues microsoft#2

ea5ca4d

TessFerrandez added security Security topic CI/CD CI/CD topic labels Dec 3, 2020

TessFerrandez requested a review from anthturner December 3, 2020 09:49

TessFerrandez assigned LizaShak Dec 3, 2020

TessFerrandez requested review from balteravishay and DariuszPorowski December 6, 2020 09:28

TessFerrandez approved these changes Dec 6, 2020

View reviewed changes

seushermsft reviewed Dec 8, 2020

View reviewed changes

continuous-integration/dev-sec-ops/secret-management/secrets_rotation.md Outdated Show resolved Hide resolved

balteravishay reviewed Dec 9, 2020

View reviewed changes

...nuous-integration/dev-sec-ops/dependency-container-scanning/dependency_container_scanning.md Outdated Show resolved Hide resolved

...nuous-integration/dev-sec-ops/dependency-container-scanning/dependency_container_scanning.md Outdated Show resolved Hide resolved

DariuszPorowski requested changes Jan 13, 2021

View reviewed changes

continuous-integration/dev-sec-ops/secret-management/secrets_rotation.md Outdated Show resolved Hide resolved

cr changes

cd16fdc

balteravishay approved these changes Feb 21, 2021

View reviewed changes

seushermsft approved these changes Mar 2, 2021

View reviewed changes

LizaShak added 2 commits March 3, 2021 12:22

Merge branch 'master' into feature/dev-sec-ops-docs

fddb27f

fix broken link

75528ce

DariuszPorowski approved these changes Mar 10, 2021

View reviewed changes

brockneedscoffee approved these changes Mar 18, 2021

View reviewed changes

brockneedscoffee self-requested a review March 18, 2021 17:20

brockneedscoffee suggested changes Mar 18, 2021

View reviewed changes

brockneedscoffee added the waiting-for-author label Apr 8, 2021

brockneedscoffee self-assigned this Apr 21, 2021

Merge branch 'main' into feature/dev-sec-ops-docs

361c382

LizaShak added 8 commits May 5, 2021 15:21

update links

285eaa0

revert change

47057e4

fix links

4bbb43b

Merge branch 'main' into feature/dev-sec-ops-docs

96d9ad1

fix links

a2f4d33

fix links

60d600b

fix links

d22cc6e

rename readme file

ad9b3ec

brockneedscoffee self-requested a review May 12, 2021 13:11

brockneedscoffee approved these changes May 12, 2021

View reviewed changes

brockneedscoffee removed the waiting-for-author label May 12, 2021

brockneedscoffee merged commit fe4cafb into microsoft:main May 12, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add DevSecOps documentation and guidance #436

Add DevSecOps documentation and guidance #436

LizaShak commented Dec 2, 2020 •

edited

Loading

TessFerrandez left a comment

DariuszPorowski commented Dec 17, 2020

DariuszPorowski left a comment

DariuszPorowski left a comment

brockneedscoffee left a comment

brockneedscoffee Mar 18, 2021

brockneedscoffee Mar 18, 2021

brockneedscoffee Mar 18, 2021

brockneedscoffee Mar 18, 2021

brockneedscoffee Mar 18, 2021

brockneedscoffee Mar 18, 2021

brockneedscoffee commented Apr 8, 2021

LizaShak commented Apr 19, 2021 •

edited

Loading

fnocera commented Apr 20, 2021 •

edited

Loading


		## Dependency and Container Scanning Frameworks and Tools

		Use the tools and pipelines as suggested in [CSEDevSecOps Dependency and Container Scanning Scenarios](https://github.com/microsoft/CSEDevSecOps/tree/master/Scenarios/DependencyContainerScanning).


		## Resources

		[CSEDevSecOps Scenarios](https://github.com/microsoft/CSEDevSecOps/tree/master/Scenarios)

Add DevSecOps documentation and guidance #436

Add DevSecOps documentation and guidance #436

Conversation

LizaShak commented Dec 2, 2020 • edited Loading

TessFerrandez left a comment

Choose a reason for hiding this comment

DariuszPorowski commented Dec 17, 2020

DariuszPorowski left a comment

Choose a reason for hiding this comment

DariuszPorowski left a comment

Choose a reason for hiding this comment

brockneedscoffee left a comment

Choose a reason for hiding this comment

brockneedscoffee Mar 18, 2021

Choose a reason for hiding this comment

brockneedscoffee Mar 18, 2021

Choose a reason for hiding this comment

brockneedscoffee Mar 18, 2021

Choose a reason for hiding this comment

brockneedscoffee Mar 18, 2021

Choose a reason for hiding this comment

brockneedscoffee Mar 18, 2021

Choose a reason for hiding this comment

brockneedscoffee Mar 18, 2021

Choose a reason for hiding this comment

brockneedscoffee commented Apr 8, 2021

LizaShak commented Apr 19, 2021 • edited Loading

fnocera commented Apr 20, 2021 • edited Loading

LizaShak commented Dec 2, 2020 •

edited

Loading

LizaShak commented Apr 19, 2021 •

edited

Loading

fnocera commented Apr 20, 2021 •

edited

Loading