Star this repo and keep track of awesome new updates.
A curated collection of tools and resources for building security with a developer first mindset.
Security with a dev-first mindset brings security closer to developers, empowering them to take ownership of security. This democratization of security changes the role of security teams to be an enabler rather than controller, and requires developers to embrace security as a first class citizen.
Your contributions are always welcome !
- Secure Development
- Continuous Security Testing
- Triage and Prioritizaiton
- Remediation Management
- Metrics and Reporting
- Training
Building security from the beginning is well accepted as the ideal goal, however it is incredibly hard to implement in practice. In a constantly changing landscape of security, it is not practical to expect every single developer to follow security practices all the time. In most organizations, where developers are at varying levels of security skills and have constantly changing priorities, it becomes important to make security simple to follow and difficult to get wrong. This is where checklists come into the picture. Building out well defined, actionable checklists and implementing those checks technically is known to significantly improve the security posture of software being built by developers. Here are a few usable checklists:
- OWASP ASVS
- Mozilla’s Web Security Checklist
- Test Driven Security in CI
- API Security Checklist
- Case studies of successfully eliminating entire classes of vulnerabilities
- Making safe coding patterns the default
- Serverless security checklist
Note: The problem of avoidable failures is not limited to security or development, in fact it is prevalent in almost every organized activity including healthcare, airlines, government etc. An excellent book to read on the importance and impact of checklists is The Checklist Manifesto
DevOps practices have introduced continuous integration (CI) which puts focus on continuously testing code during the development process. Following a similar pattern, making security verification an integral part of development process typically leads to security becoming more actionable and natural for developers to work on. Here are a few tools and resources for security testing throughout the development and deployment lifecycle:
- Orchestrate scanners in CI/CD - ReapSaw and Salus
- Orchestrate security using AWS step functions - Slides
- GitHub app for security feedback in PRs - GuardRails
- Static analysis for Infrastructure as Code - Checkov
- Open source static analysis tool - InsiderCLI
- More Scanners
- Awesome BugBounty
- Awesome Pen Testing
- Awesome Threat Modeling
- Awesome Web Hacking
- Awesome Container Security
- Building a Secure DevOps Pipeline
Security tools, especially automated scanners are notorious for generating high ratios of false positives. The easiest way to lose developers' attention and interest in security is by sending them on a wild goose chase of highly noisy vulnerability report. While this problem of high rate of false positives is still not solved, several folks are trying to solve this problem in different ways. Here are a few tools and resources that are helpful in triaging and prioritizing vulnerabilities:
- Vulnerability intelligence services to prioritize CVEs - vFeed and Vuldb and VulnDB
- Research study for using ML in improving vulnerability identification - Article
This focuses on network vulnerabilities but several concepts can be borrowed in AppSec world
- Collective intelligence for contextual prioritization
- Remediation Prioritization
- Threat Intelligence for Prioritization
Dealing with security defect backlog and getting it prioritized for remediation can be a constant challenge in most organizations. A dev-first approach to this challenge brings empathy and partnership into the mix, and puts security team in the role of an enabler rather than a controller. Here are a few excellent case studies of security and engineering partnerships:
- Building partnerships and enabling engineers - Abstract and Original Video
- Art of Vulnerability Management - Abstract and Original Video
Generating metrics for the overall AppSec program or vulnerability management program is important, however that will not necessarily move the needle with developers. A dev-first approach to AppSec metrics, is to bring visibility to each dev team of their own AppSec performance metrics and have them take ownership of it. Just like how dev teams measure their quality, reliability, performance metrics, they should be able to measure and improve their own AppSec metrics. Here are a few resources that can help you get started:
- Simple AppSec Metrics - Abstract and Original video
- More Metrics - Original Video
- Building Actionable KPIs - Slides
- Vulnerability Aggregation Tool - DefectDojo
- Dashboarding Tools - Metabase, Superset
In security, failures (bugs / defects / vulnerabilibities) are caused by not just lack of security skills. In a large majority of the cases, security defects are caused by competent developers who have too many other priorities or are not incentivized to build security or simply don't connect the dots to security risks. To address such a broad set of failure modes, security training needs to go beyond a focus on skills improvement and needs to also include things that make security interesting, fun and engaging. Building out a security champions program, organizing CTFs and gamifying the experience have led to increased developer engagement and interest towards security.