by Nikki Gannon, on Aug 5, 2019 10:25:00 AM
The recent rise in high profile ransomware attacks has driven DevSecOps into top priority for DevOps teams. Encouraging a ‘Security as Code’ mindset within a team creates best practices right from the start of a project.
The DevOps team responsible for building WedMD’s microservice automation faced this issue; they needed to run installation scripts automatically while also maintaining their HITRUST Certification. This certification is federally required by HIPAA for handling sensitive information; if an automated script sent a non-compliant change into Production, WedMB risked breaking US law.
The team choose BuildMaster to solve their issue, citing features like API pipeline automation functionality and light memory footprints. BuildMaster’s permissions and approvals functionality allowed the team to monitor, approve, and deploy any changes with confidence they were following HIPAA regulations.
BuildMaster helps teams, like WedMB, achieve agile frameworks and focus on creating new solutions for complex application lifecycles. It supports and fortifies projects as they continue to grow and adapt.
The following list of 31 DevSecOps tools, combined with BuildMaster, will help create a strong base for your DevOps project.
BuildMaster
BuildMaster is obviously our favorite DevSecOps tool. We designed BuildMaster's CI/CD pipelines to be highly customizable to meet all your security needs and to give plenty of visibility without compromising security.
Using BuildMaster, WebMD successfully transitioned from a decoupled process to a DevSecOps powerhouse. Today, the team creates build and deployment pipelines in BuildMaster to enable automated deployments for all its microservices, while still maintaining its HITRUST certification.
But there are other tools you might choose to help with DevSecOps and to implement a ‘Security as Code’ culture within your organization. BuildMaster is our #1, but here are 30 other tools you might consider.
Checkmarx
Checkmarx offers a Static Application Security Testing (SAST) tool to scan for security vulnerabilities analyzed in code. The tool enables developers to deliver secure, thoroughly analyzed and tested applications. Checkmarx enables a more secure process for application delivery by incorporating security code analysis and testing into the development process. It integrates easily with any CI/CD tool or environment.
Contrast SecurityContrast Security offers Interactive Application Security Testing (IAST), a Runtime Application Self-Protection (RASP) solution, and Contrast Protect. These tools work together to implement security detection with no scanning or scheduling required. The tools also work continuously in the background once they are integrated into users’ applications. Once a vulnerability is discovered, it then utilizes Contrast Protect. Contrast Security detects unknown threats and reports it to any security tool an organization has in place.
IMMUNIO
IMMUNIO offers a cloud-based Runtime Application Self-protection (RASP) solution to protect your web application and customers against application layer attacks.
Rather than continuously scanning code, IMMUNIO deploys an agent in the application that focuses on possible exploitations. This acts like a ‘vaccine’ for your application code. The tool hooks into the application framework, monitors the application, reports exploitable vulnerabilities, and automatically prevents attacks.
ThreatModeler
ThreatModeler performs an automated threat analysis of manually entered application data. It integrates with almost all available CI/CD tools. ThreatModeler’s intuitive UI dashboard makes it easy for teams to collaborate about application security. It also contains an Intelligent Threat Engine, which uses information from an application’s components to automatically identify each component’s security threats.
Evident.io
Evident.io enables governance, compliance, and threat protection of public cloud infrastructure. The tool helps modern DevOps, IT, and Agile teams implement their part of shared responsibility and model security. Evident.io proactively assesses and manages cloud security risk. The Evident Security platform works closely with AWS users’ cloud and identifies security misconfigurations and remediates risk.
IrisuRisk
IriusRisk was created by Continuum Security as a threat modeling tool which helps developers and security analysts handle software vulnerabilities early in the application design stage. The tool enables teams to address security risks early in the development process while it is still easy to fix. IriusRisk allows teams to create their threat models and template them as well so they can be re-used by other users. The tool implements and manages an end-to-end secure software development process.
Aqua Security
Aqua Security provides security for containers, serverless and cloud-native applications throughout the DevSecOps pipeline. The tool works across all platforms and clouds as well. Aqua Security provides security across your entire CI/CD pipeline and environments all the way from build to production. Using the tool gives teams the ability to protect their applications with complete visibility throughout the application lifecycle.
Dome9 Security
Dome9 Security aims to provide security across all public and hybrid cloud environments. The platform also provides functionality across governance, compliance, network security, and IAM protection. Control security and compliance in Azure, AWS, and Google Cloud with full visibility into everything security teams need to monitor and control. Using the tool, users have been able to protect their information from vulnerabilities that can ultimately lead to data loss and identity theft.
WhiteSource
* Looking for how to integrate WhiteSource with ProGet? It's right here.
WhiteSource monitors your open source components through every step of the software development lifecycle. The tool continuously and automatically keeps tabs on these components behind the scenes. WhiteSource’s browser plugin reveals security risks, reported bugs, and much more for each component. This enables teams to be more informed about which components to add to their builds before moving forward. The tool also detects issues within an application during the early stages when it is easier and cheaper to fix.
Gauntlt
Gauntlt is an automated security testing tool that combines several security tools to create an open-source command-line testing framework. The tool’s BDD syntax also helps to improve collaboration among teams and allow readable and structured tests. Gauntlt enables users to simulate a variety of common application tool-based penetration attack tactics and also helps teams facilitate testing and communication to hook actionable tests into your deploy and testing processes.
CA Veracode
Veracode is a DevSecOps tool that allows teams to build and deliver secured applications in a holistic and scalable way. The tool provides visibility into the status of an application across all testing types and integrates with existing tools. Veracode contains automated security tools that helps users to quickly and easily remediate software errors. This helps teams to detect flaws early in their process without adding any unnecessary and costly steps.
Fortify
Fortify identifies security vulnerabilities that threaten software and offers various methods to mitigate security risks. The tool integrates easily with your existing build, test, and deploy tools. Fortify pinpoints the root causes of vulnerabilities and provides best practices developers can use to ensure their code is securely developed. The tool automates the testing of applications across a software portfolio.
HashiCorp Vault
Vault is a security tool for accessing secrets such as certificates, API keys, or passwords. Teams can keep their secrets and data safe and protected with Vault. Vault encrypts secrets before they are writing them so that access to the raw storage won’t let users gain access. This ensures that only those who have permission can access secrets.
LogRhythm SIEM
LogRhythm SIEM creates a unified Security Intelligence Platform by combining machine analytics, file integrity monitoring, SIEM, and log management. Teams using the tool can detect remediate threats quicker than they did before. LogRhythm SIEM utilizes Threat Lifecycle Management (TLM), which is a detection and response framework for security. This helps teams to provide compliance automation, minimize risk, and increase security maturity.
Sqreen
Sqreen’s web application security monitoring and protection solution enables companies to build security into every application. This allows teams to protect their applications as well as their users from attacks. Teams can use Sqreen to enable protection tailored to each stack either in the cloud or on-premise. This gives teams visibility into the security of their applications and can scale it in production.
Qualys Cloud Platform
Qualys Cloud Platform safeguards security and compliance within your public cloud deployments. It simplifies security operations and delivers critical security intelligence. Qualys Cloud Platform gives users a continuous assessment of their security and compliance for their applications. Teams gain complete visibility across all their assets and can access reports to see where security flaws are and remediate them.
Tripwire
Tripwire is a data integrity and security tool that monitors files and alerts users if changes are made. This allows teams to easily identify threats and vulnerabilities and automate compliance. Tripwire establishes a known baseline and checks the current filesystem. If changes are made, the tool alerts the user of any changes that are detected. Users can then choose to upgrade a package to establish a new baseline.
Venafi Trust Protection Platform (TPP)
Venafi TPP protects machine identities across your infrastructure to prevent data loss and security vulnerabilities. Teams using Venafi TPP can increase their visibility and respond to incidents quickly. Venafi TPP automates the continuous discovery and monitoring process of machine identities. If an issue is detected, it can automatically remediate it. This gives teams the peace of mind that their keys and certificates are protected within their data centers.
OWASP Zed Attack Proxy (ZAP)
OWASP ZAP is widely used by those who manually test their security within their web applications. The tool helps teams to implement better security practices within their CI/CD pipeline. OWASP ZAP contains an active scanner that integrates with many existing tools and functions that teams are currently using. It also allows users to save sessions and come back so they can confirm fixes and remediations.
SecureAssist
SecureAssist’s static analysis automatically detects application vulnerabilities and offers solutions on how to remediate each issue. This allows teams to detect issues early before an application moves too far within its lifecycle. SecureAssist detects vulnerabilities as you code and teaches secure coding practices so users can learn to easily identify and remediate issues. This decreases security risks and increases the speed of software delivery.
CyberArk Conjur
CyberArk Conjur is an open source security platform that integrates with the DevOps toolchain. It manages secrets tailored to each industry’s infrastructure requirements and environments. CyberArk Conjur allows users to write policy files to organize items within your infrastructure. These policies can also be used to define relationships for specific secrets.
Twistlock
Twistlock is a comprehensive cloud native security platform that offers protection for your hosts, containers, and serverless components. The tool is lightweight, scalable, and automated to help you maintain effective security practices. Twistlock is a full stack solution that secures the contents of container environments and internal applications at every stage of their lifecycles. Automated policies are created through machine learning and the enforcement of these policies integrates throughout the development lifecycle.
SD Elements
SD Elements addresses challenges organizations face regarding business alignment, defensibility, security skills/awareness gaps, privacy, and compliance. The tool helps users build key capabilities into their application security program. SD Elements automates the process of tracking security defects and identifying necessary security roles. This is executed through the advanced automation platform to address these challenges organizations face and build policy, compliance, and security into applications.
Snort
Snort is an open source network intrusion system that monitors network traffic in real-time. The tool is commonly used in Transmission Control Protocol/Internet Protocol (TCP/IP) traffic sniffers and analyzers. Snort’s monitoring system checks each package closely to ensure it does not contain any suspicious anomalies or dangerous payloads. The tool then sends real-time alerts if any suspicious behavior is detected.
Charles Proxy
Charles Proxy is a web debugging application that enables a developer to view SSL/HTTPS and HTTP traffic between their machine and the internet. It is widely used by security testers to ensure their application or website is running correctly and securing sent data. Charles Proxy tracks response times and the sizes of messages. It also can rewrite requests and debug the content during HTTPS sessions.
SonarQube
SonarQube is an open source platform that manages code quality through continuous inspection. The tool supports over 25 programming languages and integrates with your existing workflow. SonarQube shows the health of an application along with highlighting any new issues. This allows users to quickly detect code errors and fix them which improves the code quality overall.
Klockwork
Klockwork understands that short timelines, feature demands, and strict standards make it difficult to find bugs and fix security flaws. The tool helps alleviate that pain by detecting errors early in the application lifecycle. Klockwork supports CI tools which helps to perform analysis on code changes. Using static code analysis, the tool identifies critical safety, reliability, and coding standards for developers.
Black Duck
Black Duck contains two tools within its platform: Black Duck Software Composition Analysis and Black Duck Open Source Audits. Using the two of these together allows teams to track their code and mitigate any security and license compliance risks. Using Black Duck enables automatic open source policy enforcement without the need to change tool sets or processes. It also implements a multi-factor detection and identifies vulnerabilities within code.
Kiuwan
Kiuwan offers an end-to-end platform for securing applications. It supports a variety of languages as well as web, mobile, and legacy systems. Kiuwan discovers open source vulnerabilities and license compliance so that any issues are detected and able to be corrected early. Teams can also automate their policies throughout the software development lifecycle.
Signal Sciences
Signal Sciences utilizes their tools, next-gen web application firewall (WAF) and runtime application self-protection (RASP) to increase security and maintain reliability within applications and multi-cloud platforms. Signal Sciences’ technology enables teams to deliver modern applications and API’s that are well protected. Flexible deployments and automated blocking help keep modern applications secure without sacrificing development or operations goals.
- 10 Key Capabilities of Signal Sciences Next-gen WAF and RASP
- Next-Generation Web Application Firewall
- Runtime Application Self-Protection
Don't Compromise Security for Speed
Security is top priority at every stage of your DevOps process. IT Organizations must maintain vigilance as cyber attacks increase year over year. Tools like BuildMaster and those above will help.
BuildMaster maximizes developer time, minimizes release risk, and boosts DevSecOps efficiency without upgrading current tech or rigorous training. Best of all, BuildMaster will do this all for free in our free forever version.
