by Nikki Gannon, on Aug 5, 2019 10:25:00 AM
DevSecOps integrates security practices into DevOps processes. By developing a mindset that everybody on a team is responsible for security, which creates a ‘Security as Code’ culture within organizations. The goal of DevSecOps is to work within an agile framework and focus on creating new solutions for complex application lifecycles.
The list below contains a list of the best DevSecOps tools that can help you implement a ‘Security as Code’ culture within your organization.
DevSecOps Tools
1. Checkmarx
Checkmarx offers a Static Application Security Testing (SAST) tool to scan for security vulnerabilities analyzed in code. The tool enables developers to deliver secure, thoroughly analyzed and tested applications.
Checkmarx enables a more secure process for application delivery by incorporating security code analysis and testing into the development process. It integrates easily with any CI/CD tool or environment.
Features :
- Static application security testing
- Open source analysis
- Interactive application security testing
- Developer AppSec training
Sources:
2. Contrast SecurityContrast Security offers Interactive Application Security Testing (IAST), a Runtime Application Self-Protection (RASP) solution, and Contrast Protect. These tools work together to implement security detection with no scanning or scheduling required.
The tools also work continuously in the background once they are integrated into users’ applications. Once a vulnerability is discovered, it then utilizes Contrast Protect. Contrast Security detects unknown threats and reports it to any security tool an organization has in place.
Features:
- Deep security instrumentation
- Automated inventory, discovery, and awareness
- SaaS or on-premise deployment, enterprise-class scalability
- Centralized control and real-time reporting
- DevOps-by-design with tight integrations
Sources:
3. IMMUNIO
IMMUNIO offers a cloud-based Runtime Application Self-protection (RASP) solution to protect your web application and customers against application layer attacks.
Rather than continuously scanning code, IMMUNIO deploys an agent in the application that focuses on possible exploitations. This acts like a ‘vaccine’ for your application code. The tool hooks into the application framework, monitors the application, reports exploitable vulnerabilities, and automatically prevents attacks.
Features:
- Discover threats and other malicious behavior
- Remediate critical vulnerabilities
- Protect integrity of server code, user accounts, and web client templates
Sources:
4. ThreatModeler
ThreatModeler performs an automated threat analysis of manually entered application data. It integrates with almost all available CI/CD tools.
ThreatModeler’s intuitive UI dashboard makes it easy for teams to collaborate about application security. It also contains an Intelligent Threat Engine, which uses information from an application’s components to automatically identify each component’s security threats.
Features:
- Real-time reporting on security threats
- Identifies problematic code to provide information needed to build a protection plan
- Dashboards which allow teams to influence application security
Sources:
5. Evident.io
Evident.io enables governance, compliance, and threat protection of public cloud infrastructure. The tool helps modern DevOps, IT, and Agile teams implement their part of shared responsibility and model security.
Evident.io proactively assesses and manages cloud security risk. The Evident Security platform works closely with AWS users’ cloud and identifies security misconfigurations and remediates risk.
Features:
- Complete visibility across clouds
- Continuous threat protection
- Simplified compliance management
- Scan container images and Infrastructure as Code (IaC) templates
Sources:
6. IrisuRisk
IriusRisk was created by Continuum Security as a threat modeling tool which helps developers and security analysts handle software vulnerabilities early in the application design stage. The tool enables teams to address security risks early in the development process while it is still easy to fix.
IriusRisk allows teams to create their threat models and template them as well so they can be re-used by other users. The tool implements and manages an end-to-end secure software development process.
Features:
- Risk analysis and detection for vulnerabilities
- Security requirements to limit vulnerabilities and promote compliance
- Threat modeling and technical security requirements
- Code review for quality assurance
- Security testing to review flaws and maintain functionality
Sources:
7. Aqua Security
Aqua Security provides security for containers, serverless and cloud-native applications throughout the DevSecOps pipeline. The tool works across all platforms and clouds as well.
Aqua Security provides security across your entire CI/CD pipeline and environments all the way from build to production. Using the tool gives teams the ability to protect their applications with complete visibility throughout the application lifecycle.
Features:
- Automated DevSecOps to help implement security processes
- Modernize security to eliminate vulnerabilities
- Compliance and auditing capabilities
- Serverless containers and functions
- Hybrid cloud and multi-cloud work environments
Sources:
8. Dome9 Security
Dome9 Security aims to provide security across all public and hybrid cloud environments. The platform also provides functionality across governance, compliance, network security, and IAM protection.
Control security and compliance in Azure, AWS, and Google Cloud with full visibility into everything security teams need to monitor and control. Using the tool, users have been able to protect their information from vulnerabilities that can ultimately lead to data loss and identity theft.
Features:
- Complete visibility over workloads
- Scalable security operations and secure DevOps
- Compliance automation and governance enforcement
- Configuration management to maintain consistency
Sources:
9. WhiteSource
* Looking for how to integrate WhiteSource with ProGet? It's right here.
WhiteSource monitors your open source components through every step of the software development lifecycle. The tool continuously and automatically keeps tabs on these components behind the scenes.
WhiteSource’s browser plugin reveals security risks, reported bugs, and much more for each component. This enables teams to be more informed about which components to add to their builds before moving forward. The tool also detects issues within an application during the early stages when it is easier and cheaper to fix.
Features:
- Inventory of all open source components
- Risk reports to highlight errors and vulnerabilities
- Detailed security vulnerabilities list
- Aggregated report for all alerts
Sources:
10. Gauntlt
Gauntlt is an automated security testing tool that combines several security tools to create an open-source command-line testing framework. The tool’s BDD syntax also helps to improve collaboration among teams and allow readable and structured tests.
Gauntlt enables users to simulate a variety of common application tool-based penetration attack tactics and also helps teams facilitate testing and communication to hook actionable tests into your deploy and testing processes.
Features:
- Attacks are written in an easy-to-read language
- Easily hooks into existing testing tools and processes
- Comes with security tool adapters
- Uses Unix standard error and standard out to pass status
Sources:
11. CA Veracode
Veracode is a DevSecOps tool that allows teams to build and deliver secured applications in a holistic and scalable way. The tool provides visibility into the status of an application across all testing types and integrates with existing tools.
Veracode contains automated security tools that helps users to quickly and easily remediate software errors. This helps teams to detect flaws early in their process without adding any unnecessary and costly steps.
Features:
- Static analysis security testing to identify and remediate application security flaws
- Software composition analysis to identify what libraries are being used and if they contain vulnerabilities that will affect your applications
- Vendor analysis security testing
- Web application scanning
Sources:
12. Fortify
Fortify identifies security vulnerabilities that threaten software and offers various methods to mitigate security risks. The tool integrates easily with your existing build, test, and deploy tools.
Fortify pinpoints the root causes of vulnerabilities and provides best practices developers can use to ensure their code is securely developed. The tool automates the testing of applications across a software portfolio.
Features:
- Automation and enterprise workflow integration
- Available on-premise, as a service, or in hybrid
- Compliance management to ensure all rules are being followed
- Manage enterprise application security risk
- Optimize scan results with agent technology
Sources:
13. HashiCorp Vault
Vault is a security tool for accessing secrets such as certificates, API keys, or passwords. Teams can keep their secrets and data safe and protected with Vault.
Vault encrypts secrets before they are writing them so that access to the raw storage won’t let users gain access. This ensures that only those who have permission can access secrets.
Features:
- Secure secret storage to encrypt and store data
- Revoke secrets immediately after use
- Detailed audit logs that provide a history of interactions used to detect breaches
- Lease and revoke secrets automatically or manually
Sources:
14. LogRhythm SIEM
LogRhythm SIEM creates a unified Security Intelligence Platform by combining machine analytics, file integrity monitoring, SIEM, and log management. Teams using the tool can detect remediate threats quicker than they did before.
LogRhythm SIEM utilizes Threat Lifecycle Management (TLM), which is a detection and response framework for security. This helps teams to provide compliance automation, minimize risk, and increase security maturity.
Features:
- AI engine delivers real-time visibility to risks
- Collection technology that facilitates aggregation of log data, security events, and other machine data
- File integrity monitoring to protect all files
- Case management to ensure vulnerabilities don’t slip through the cracks
- Reporting and smart response for incidents and vulnerability management
Sources:
15. Sqreen
Sqreen’s web application security monitoring and protection solution enables companies to build security into every application. This allows teams to protect their applications as well as their users from attacks.
Teams can use Sqreen to enable protection tailored to each stack either in the cloud or on-premise. This gives teams visibility into the security of their applications and can scale it in production.
Features:
- Automatic defense against attacks
- Insights you can act on to prevent issues
- Scalable, collaborative security
Sources:
16. Qualys Cloud Platform
Qualys Cloud Platform safeguards security and compliance within your public cloud deployments. It simplifies security operations and delivers critical security intelligence.
Qualys Cloud Platform gives users a continuous assessment of their security and compliance for their applications. Teams gain complete visibility across all their assets and can access reports to see where security flaws are and remediate them.
Features:
- Virtual, internet, and passive scanners for fast and efficient scanning and analysis
- Cloud agents and sensors for continuous visibility
- APIs and integrations to automate deployments
Sources:
17. Tripwire
Tripwire is a data integrity and security tool that monitors files and alerts users if changes are made. This allows teams to easily identify threats and vulnerabilities and automate compliance.
Tripwire establishes a known baseline and checks the current filesystem. If changes are made, the tool alerts the user of any changes that are detected. Users can then choose to upgrade a package to establish a new baseline.
Features:
- Monitor system integrity with real-time data and security automation
- Manage network vulnerabilities to improve security and risk mitigation
- Automate regulatory compliance
- Maximize operations up-time
Sources:
18. Venafi Trust Protection Platform (TPP)
Venafi TPP protects machine identities across your infrastructure to prevent data loss and security vulnerabilities. Teams using Venafi TPP can increase their visibility and respond to incidents quickly.
Venafi TPP automates the continuous discovery and monitoring process of machine identities. If an issue is detected, it can automatically remediate it. This gives teams the peace of mind that their keys and certificates are protected within their data centers.
Features:
- Ensures complete visibility and maps access to all servers, users, and applications
- Enforces policies and workflows to provide flexible policy control
- Automates and scales certificates associated to a user
- Identifies incidents and remediates immediately
Sources:
19. OWASP Zed Attack Proxy (ZAP)
OWASP ZAP is widely used by those who manually test their security within their web applications. The tool helps teams to implement better security practices within their CI/CD pipeline.
OWASP ZAP contains an active scanner that integrates with many existing tools and functions that teams are currently using. It also allows users to save sessions and come back so they can confirm fixes and remediations.
Features:
- Flexible scan policy management
- Highly scriptable to work within any language
- Websocket testing to ensure a connection between clients and servers
Sources:
20. SecureAssist
SecureAssist’s static analysis automatically detects application vulnerabilities and offers solutions on how to remediate each issue. This allows teams to detect issues early before an application moves too far within its lifecycle.
SecureAssist detects vulnerabilities as you code and teaches secure coding practices so users can learn to easily identify and remediate issues. This decreases security risks and increases the speed of software delivery.
Features:
- Learn to securely code while you work
- Fits into your current development processes
- Keeps software development lifecycle on track
Sources:
21. CyberArk Conjur
CyberArk Conjur is an open source security platform that integrates with the DevOps toolchain. It manages secrets tailored to each industry’s infrastructure requirements and environments.
CyberArk Conjur allows users to write policy files to organize items within your infrastructure. These policies can also be used to define relationships for specific secrets.
Features:
- Comprehensive secrets management
- Role-based access controls
- Centralized, tamper-proof audit records
- Integration with DevOps toolchain
- Cloud scalability, performance, and availability
Sources:
22. Twistlock
Twistlock is a comprehensive cloud native security platform that offers protection for your hosts, containers, and serverless components. The tool is lightweight, scalable, and automated to help you maintain effective security practices.
Twistlock is a full stack solution that secures the contents of container environments and internal applications at every stage of their lifecycles. Automated policies are created through machine learning and the enforcement of these policies integrates throughout the development lifecycle.
Features:
- Vulnerability management scans images at the build
- Compliance with over 200 built-in checks implemented and continuous monitoring
- Runtime defense with automated security models enforced across environments
- CI/CD fully integrated into build and deployment pipelines
- Cloud security launch partner with AWS/Google/Azure that can help teams find cloud native platform services
Sources:
23. SD Elements
SD Elements addresses challenges organizations face regarding business alignment, defensibility, security skills/awareness gaps, privacy, and compliance. The tool helps users build key capabilities into their application security program.
SD Elements automates the process of tracking security defects and identifying necessary security roles. This is executed through the advanced automation platform to address these challenges organizations face and build policy, compliance, and security into applications.
Features:
- Secure SDLC and content features to build security early in the software development lifecycle
- Enterprise readiness to adapt to your processes and workflow
- Custom plug-in framework to add features and functionality that fits your needs
- Integrations with many existing application lifestyle management systems that fit your workflow
Sources:
24. Snort
Snort is an open source network intrusion system that monitors network traffic in real-time. The tool is commonly used in Transmission Control Protocol/Internet Protocol (TCP/IP) traffic sniffers and analyzers.
Snort’s monitoring system checks each package closely to ensure it does not contain any suspicious anomalies or dangerous payloads. The tool then sends real-time alerts if any suspicious behavior is detected.
Features:
- Real-time reporting and alerts for security and compliance
- Automated package monitoring
- Define rules for packages to be analyzed
Sources:
25. OSSEC
OSSEC is an open source host-based intrusion detection system that allows users to manage and monitor their systems. The tool performs log analysis, Windows registry monitoring, integrity checking, active response, time-based alerting, and rootkit detection.
OSSEC helps users meet specific compliance requirements. Monitors Application and product log files for unauthorized file system access/modification, and alerts relevant team members as necessary.
Features:
- File integrity checking that detects changes when they happen to prevent attacks
- Log monitoring that collects, analyzes, and makes correlations of any suspicious activity
- Rootkit detection to receive notifications when the system is modified
- Active response to act on issues when alerts are triggered
Sources:
26. Charles Proxy
Charles Proxy is a web debugging application that enables a developer to view SSL/HTTPS and HTTP traffic between their machine and the internet. It is widely used by security testers to ensure their application or website is running correctly and securing sent data.
Charles Proxy tracks response times and the sizes of messages. It also can rewrite requests and debug the content during HTTPS sessions.
Features:
- SSL proxying to debug content of HTTPS sessions
- Bandwidth throttling to experience your site as a modern user would
- AJAX to see the actual XML between the client and server
- Native support for Flash Remoting
- Autoconfigure browser and system proxy settings
Sources:
27. SonarQube
SonarQube is an open source platform that manages code quality through continuous inspection. The tool supports over 25 programming languages and integrates with your existing workflow.
SonarQube shows the health of an application along with highlighting any new issues. This allows users to quickly detect code errors and fix them which improves the code quality overall.
Features:
- Overall health of project displayed on main page
- Focus on the leak to manage code quality
- Enforce quality code by setting up quality requirements
- Dig into issues to determine where they are located and how to remediate them
- Highlight hot spots that need your attention
- Visualize the history of a project to review project details
Sources:
28. Klockwork
Klockwork understands that short timelines, feature demands, and strict standards make it difficult to find bugs and fix security flaws. The tool helps alleviate that pain by detecting errors early in the application lifecycle.
Klockwork supports CI tools which helps to perform analysis on code changes. Using static code analysis, the tool identifies critical safety, reliability, and coding standards for developers.
Features:
- Static code analysis for security and safety detection
- Predictive analysis to model and forecasts functions within your applications
- Application security for vulnerability detection
- Application performance management for deep insights into application performance and responses
Sources:
29. Black Duck
Black Duck contains two tools within its platform: Black Duck Software Composition Analysis and Black Duck Open Source Audits. Using the two of these together allows teams to track their code and mitigate any security and license compliance risks.
Using Black Duck enables automatic open source policy enforcement without the need to change tool sets or processes. It also implements a multi-factor detection and identifies vulnerabilities within code.
Features:
- Open source code identification and policies management
- License and identity risks discovery
- Threat monitoring and alerts for application safety and security
- Vulnerable components mapping to detect issues
Sources:
30. Kiuwan
Kiuwan offers an end-to-end platform for securing applications. It supports a variety of languages as well as web, mobile, and legacy systems.
Kiuwan discovers open source vulnerabilities and license compliance so that any issues are detected and able to be corrected early. Teams can also automate their policies throughout the software development lifecycle.
Features:
- Customizable application analysis models
- Portfolio management for applications
- Customizable dashboard to promote collaboration
- Customizable reports for data assessment and vulnerability detection
- Progress tracking and action plans for application safety and success
Sources:
31. Signal Sciences
Signal Sciences utilizes their tools, next-gen web application firewall (WAF) and runtime application self-protection (RASP) to increase security and maintain reliability within applications and multi-cloud platforms.
Signal Sciences’ technology enables teams to deliver modern applications and API’s that are well protected. Flexible deployments and automated blocking help keep modern applications secure without sacrificing development or operations goals.
Features:
- Guides engineers to fix the right things
- Identifies and blocks bots and scrapers to protect your resources
- Instruments and protects your apps without breaking them
- Automated blocking that scales without rules tuning
Sources:
- 10 Key Capabilities of Signal Sciences Next-gen WAF and RASP
- Next-Generation Web Application Firewall
- Runtime Application Self-Protection
Looking to keep your DevOps pipelines secure and ease the auditing process burden? Inedo DevOps tools maximize developer time, minimize release risk, and empower stakeholders to bring their vision to life faster. All with the people and technology you have right now. To get help streamlining your CI/CD processes, contact mgoulis@inedo.com.