Resources
4 min read
Last updated:
DevSecOps combines the responsibilities of development, security and operations in order to make everyone accountable for security in line with the ongoing activities conducted by development and operations teams.
DevSecOps tools serve to assist the user in minimising risk as part of the development process and also support security teams by allowing them to observe the security implications of code in production.
In this guide, we are comparing the top DevSecOps tools that can make your engineering activities more seamless, secure and observable.
Contents
Gauntlt
Our first DevSecOps tool suggested is contributed by Hew Blair Chairman at Justerini & Brooks Ltd; “The one DecSecOp tool that I'm using for some time now and would highly recommend is Gauntlt.
It is an open-source command-line testing framework that merges several security tools, allowing users to perform tests and suites that can be efficiently admitted into the deployment and testing processes.”
“It allows users to create and perform tests from different tools (curl, sslyze, heartbleed, and more) to attack and penetrate the application. It also uses BDD syntax to deduct readable and structured tests and assists with improving collaboration between the teams that are building the application.”
Red Hat Ansible
The second expert contributed tool was cited by cybersecurity researcher Lumena Mukherjee in his response: “Red Hat Ansible streamlines the operations side of the software development process.”
“Red Hat Ansible assists admins in maintaining and managing their infrastructure through IT automation, configuration management, and automatic deployments. It does so via automation modules written in Python, Powershell, etc. that are executed sequentially as per user-defined specifications in the Ansible playbook.”
JupiterOne
JupiterOne was included as a leading DevSecOps solution by Jasmine Henry Director of Cybersecurity at Esper.io; “JupiterOne creates continuous observability, an idea which is very much core to DevSecOps.”
“Today's cloud environments are incredibly dynamic and vast, and there can be constant changes to the security status of assets in development, testing, and production. Any privileged user can gain continuous observability via JupiterOne.”
“JupiterOne filters out the noise so I can act on meaningful changes. It provides real-time visibility into our compliance with SOC 2, PCI, and other regulatory frameworks, and more importantly, it automated evidence gathering so we'll be ready to pass an audit with flying colours when the time comes.”
IriusRisk
Our next specialist recommendation is from Emily Deaton from LetMeBank; “My favourite DevSecOp tool is IriusRisk. IriusRisk is a tool that enables the creation of threat models using a questionnaire-based system.”
“Based on the information provided, it generates a threat model along with a list of potential security risks and suggested fixes. These risks can then be tracked, along with actions taken, to make sure that suitable countermeasures are put into effect.
Information from external sources can be easily imported into the tool, and the current status can be viewed through clear summary reports.”
GitHub Actions
GitHub Actions allow developers to create workflows that can be triggered by adding .yml files placed in the .github/workflow directory of a repository, as a result, these workflows can be configured to launch a number of steps that can perform tasks such as testing or deployment.
GitHub actions are easy to debug in the event an error occurs as the results of each step are displayed clearly after each workflow has run.
Logit.io
Logit.io is an observability platform built by engineers for engineers to offer data visualisation, alerting and monitoring powered by the open-source tools ELK & Grafana. The platform is used by companies such as Maersk, IBM, Murphy Oil & Nikon.
Among the many use cases that Logit.io is tailored for, the platform is primarily used for log management, container and cloud monitoring. Logit.io is UK government approved and is compliant with PCI, SOC-2, HIPAA and GDPR.
Troubleshooting your application errors, securing your code and complete centralisation of your logs and metrics has never been easier or more affordable than when using the Logit.io platform.
Logit.io is also rated 5/5 stars on Capterra, Software Advice and Gartner.
OWASP ZAP
OWASP ZAP is another popular open-source security tool designed with developers in mind as the solution provides them with the ability to automatically scan web applications for vulnerabilities, engage port scanning and ongoing vulnerability scanning of WebSockets.
OWASP ZAP can be integrated into your CI/CD pipeline with ease to perform active scans of APIs within the automation pipeline.
PK Hub
PK Hub provides seamless credential management for those involved in the DevSecOps pipeline. The tool combines the best features of secure password management by offering storage for SSH keys, API endpoints and other environment variables so that local storage of this vital information isn’t required and can allow remote-based teams secure access to their servers.
By using aes+cbc+hmac authenticated encryption your data is protected and you can simply monitor Kubernetes, or Docker compose (for example) from anywhere that you have a shell by using a simple cli secret injection.
If you are looking for a new tool to make handling Kubernetes easier then look no further than our guide covering all of the leading Kubernetes management tools.
SonarQube
The next tool recommendation came from a developer with fifteen years of experience in this field, Matthew Brett, Senior Software Developer at AccountsPortal; “Currently, my favourite tool for DevSecOps is SonarQube.”
“SonarQube is an open-source tool that can automatically detect bugs, and vulnerabilities in code, allowing you to identify issues as quickly as they come up. Users get non-stop code inspection across all nodes of the project. In addition, this tool supports multiple programming languages.”
Value Stream Mapping
Our last “tool” suggestion came highly rated by Eugene Gotimer, DevSecOps Senior Engineer at Steampunk; “My favourite tool for DevSecOps isn't a security tool at all. It's value stream mapping.”
“As your team goes through a release, write down each step involved, automated or not, how much time you spent on it, and when it started. Once you release, look at all the steps, the effort spent on each step, and the time spent waiting between steps. Not only is it usually an eye-opener for management, but you'll see where the biggest constraint is, and that's what you need to fix.”
“The security tool that adds the most benefit quickly for a team is Software Composition Analysis (SCA). Open-source tools like OWASP Dependency-Check and OWASP Dependency Track look at the libraries and dependencies you use and match them against lists of components with known vulnerabilities. There are many commercial options as well, like Sonatype Nexus Lifecycle or Contrast Security OSS. Their findings are usually easy to remediate, and your security improves quickly.”
If you enjoyed this resource on the top tools for DevSecOps then why not check out our previous guide on is Teamviewer safe? or check out our guide to what is Kaggle?