Courses & TutorialsSecurity & Cloud

Awesome DevSecOps – Massive Collection of Resources

Spread the love

Curating the best DevSecOps resources and tooling.

DevSecOps is an extension of the DevOps movement that aims to bring security practices into the development lifecycle through developer-centric security tooling and processes.





  • MyDevSecOpsSnyk – A community that runs conferences, a blog, a podcast and a Slack workspace dedicated to DevSecOps.


  • AppSec DayOWASP – An Australian application security conference run by OWASP.
  • DevSecConSnyk – A network of DevSecOps conferences run by Snyk.


  • Absolute AppSecSeth Law & Ken Johnson – Discussions about current events and specific topics related to application security.
  • Application Security PodcastSecurity Journey – Interviews with industry experts about specific application security concepts.
  • BeerSecOpsAqua Security – Breaking down the silos of Dev, Sec and Ops, discussing topics that span these subject areas.
  • DevSecOps Podcast SeriesOWASP – Discussions with thought leaders and practitioners to integrate security into the development lifecycle.
  • The Secure DeveloperSnyk – Discussion about security tools and best practices for software developers.

Secure Development Guidelines

Secure Development Lifecycle Framework


  • Periodic Table of DevOps ToolsXebiaLabs – A collection of DevSDevOps and security ecOps tooling categorised by tool functionality.
  • Secure DevOps ToolchainSANS – A list of security specific practices and tooling categorised into pipeline phases and tool functionality.


  • CybraryCybrary – Subscription based online courses with dedicated categories for cybersecurity and DevSecOps.
  • PentesterLabPentesterLab – Hands on labs to understand and exploit simple and advanced web vulnerabilities.
  • Practical DevSecOpsPractical DevSecOps – Learn DevSecOps concepts, tools, and techniques from industry experts with practical DevSecOps using state of the art browser-based labs.
  • Secure Code WarriorSecure Code Warrior – Gamified and hands-on secure development training with support for courses, assessments and tournaments.
  • SecureFlagOWASP – Hands-on secure coding training for Developers and Build/Release Engineers.
  • Security Training for EngineersPager Duty – A presentation created and open-sourced by PagerDuty to provide security training to software engineers.
  • Security Training for EveryonePager Duty – A presentation created and open-sourced by PagerDuty to provide security training employees.
  • Web Security AcademyPortSwigger – A set of materials and labs to learn and exploit common web vulnerabilities.


  • DevSecOps HubSnyk – Introduction to key DevSecOps concepts, processes and technologies.


Dependency Management

Open source software packages can speed up the development process by allowing developers to implement functionality without having to write all of the code. However, with the open source code comes open source vulnerabilities. Dependency management tools help manage vulnerabilities in open source packages by identifying and updating packages with known vulnerabilities.

  • DependabotGitHub – Automatically scan GitHub repositories for vulnerabilities and create pull requests to merge in patched dependencies.
  • Dependency-CheckOWASP – Scans dependencies for publicly disclosed vulnerabilities using CLI or build server plugins.
  • Dependency-TrackOWASP – Monitor the volume and severity of vulnerable dependencies across multiple projects over time.
  • JFrog XRayJFrog – Security and compliance analysis for artifacts stored in JFrog Artifactory.
  • NPM AuditNPM – Vulnerable package auditing for node packages built into the npm CLI.
  • RenovateWhiteSource – Automatically monitor and update software dependencies for multiple frameworks and languages using a CLI or git repository apps.
  • Requires.ioOlivier Mansion & Alexis Tabary – Automated vulnerable dependency monitoring and upgrades for Python projects.
  • Snyk Open SourceSnyk – Automated vulnerable dependency monitoring and upgrades using Snyk’s dedicated vulnerability database.

Dynamic Analysis

Dynamic Analysis Security Testing (DAST) is a form of black-box security testing where a security scanner interacts with a running instance of an application, emulating malicious activity to find common vulnerabilities. DAST tools are commonly used in the initial phases of a penetration test, and can find vulnerabilities such as cross-site scripting, SQL injection, cross-site request forgery and information disclosure.

  • Automatic API Attack ToolImperva – Perform automated security scanning against an API based on an API specification.
  • BurpSuite Enterprise EditionPortSwigger – BurpSuite’s web application vulnerability scanner used widely by penetration testers, modified with CI/CD integration and continuous monitoring over multiple web applications.
  • GauntltGauntlt – A Behaviour Driven Development framework to run security scans using common security tools and test output, defined using Gherkin syntax.
  • SSL Labs ScanSSL Labs – Automated scanning for SSL / TLS configuration issues.
  • Zed Attack Proxy (ZAP)OWASP – An open-source web application vulnerability scanner, including an API for CI/CD integration.

Infrastructure as Code Analysis

Infrastructure as Code allows applications to be deployed reliably to a consistent environment. This not only ensures that infrastructure is consistently hardened, but also provides an opportunity to statically and dynamically analyse infrastructure definitions for vulnerable dependencies, hard-coded secrets, insecure configuration and unintentional changes in security configuration. The following tools facilitate this analysis.

Cloud Formation

  • Cfn NagStelligent – Scan AWS CloudFormation templates for insecure configuration.
  • CheckovBridgecrew – Scan Terraform, AWS CloudFormation and Kubernetes templates for insecure configuration.


  • Anchore EngineAnchore, Inc – Deep inspection of Docker images for CVEs and checking against custom policies. Engine behind their enterprise products that integrate against registries, orchestrators and CI/CD products.
  • ClairQuay – Scan App Container and Docker containers for publicly disclosed vulnerabilities.
  • DagdaElías Grande – Compares OS and software dependency versions installed in Docker containers with public vulnerability databases, and also performs virus scanning.
  • HadolintHadolint – Checks a Dockerfile against known rules and validates inline bash code in RUN statements.
  • Snyk ContainerSnyk – Scan Docker and Kubernetes applications for security vulnerabilities during CI/CD or via continuous monitoring.
  • TrivyAqua Security – Simple and comprehensive vulnerability scanner for containers.


  • CheckovBridgecrew – Scan Terraform, AWS CloudFormation and Kubernetes templates for insecure configuration.
  • RegulaFugue – Evaluate Terraform infrastructure-as-code for potential security misconfigurations and compliance violations prior to deployment.
  • TerrascanCesar Rodriguez – Scan Terraform templates for best practice security configuration.
  • TfsecLiam Galvin – Scan Terraform templates for security misconfiguration and noncompliance with AWS, Azure and GCP security best practice.


  • CheckovBridgecrew – Scan Terraform, AWS CloudFormation and Kubernetes templates for insecure configuration.
  • Kube-ScoreGustav Westling – Scan Kubernetes object definitions for security and performance misconfiguration.
  • Kubectrl KubesecControlPlane – Plugin for to perform security risk analysis for Kubernetes resources.

Intentionally Vulnerable Applications

Intentionally vulnerable applications are often useful when developing security tests and tooling to provide a place you can run tests and make sure they fail correctly. These applications can also be useful for understanding how common vulnerabilities are introduced into applications and let you practice your skills at exploiting them.

  • Bad SSLThe Chromium Project – A container running a number of webservers with poor SSL / TLS configuration. Useful for testing tooling.
  • CfngoatBridgecrew – Cloud Formation templates for creating stacks of intentionally insecure services in AWS. Ideal for testing the Cloud Formation Infrastructure as Code Analysis tools above.
  • Damn Vulnerable Web AppRyan Dewhurst – A web application that provides a safe environment to understand and exploit common web vulnerabilities.
  • Juice ShopOWASP – A web application containing the OWASP Top 10 security vulnerabilities and more.
  • NodeGoatOWASP – A Node.js web application that demonstrates and provides ways to address common security vulnerabilities.
  • TerragoatBridgecrew – Terraform templates for creating stacks of intentionally insecure services in AWS, Azure and GCP. Ideal for testing the Terraform Infrastructure as Code Analysis tools above.
  • Vulnerable Web Apps DirectoryOWASP – A collection of vulnerable web applications for learning purposes.


It’s not enough to test and harden our software in the lead up to a release. We must also monitor our production software for usage, performance and errors to capture malicious behavior and potential security flaws that we may need to respond to or address. A wide variety of tools are available to monitor different aspects of production software and infrastructure.

  • CsperCsper – A set of Content Security Policy tools that can test policies, monitor CSP reports and provide metrics and alerts.

Secrets Management

The software we write needs to use secrets (passwords, API keys, certificates, database connection strings) to access resources, yet we cannot store secrets within the codebase as this leaves them vulnerable to compromise. Secret management tools provide a means to securely store, access and manage secrets.

  • Ansible VaultAnsible – Securely store secrets within Ansible pipelines.
  • AWS Key Management Service (KMS)Amazon AWS – Securely store secrets within AWS.
  • Azure Key VaultMicrosoft Azure – Securely store secrets within Azure.
  • BlackBoxStackExchange – Encrypt credentials within your code repository.
  • Chef VaultChef – Securely store secrets within Chef.
  • CredStashFugue – Securely store secrets within AWS using KMS and DynamoDB.
  • CyberArk Application Access ManagerCyberArk – Secrets management for applications including secret rotation and auditing.
  • Docker SecretsDocker – Store and manage access to secrets within a Docker swarm.
  • Git SecretsAmazon AWS – Scan git repositories for secrets committed within code or commit messages.
  • GopassGopass – Password manager for teams relying on Git and gpg. Manages secrets in encrypted files and repositories.
  • Google Cloud Key Management Service (KMS)Google Cloud Platform – Securely store secrets within GCP.
  • HashiCorp VaultHashiCorp – Securely store secrets via UI, CLI or HTTP API.
  • Pinterest KnoxPinterest – Securely store, rotate and audit secrets.
  • Secrets Operations (SOPS)Mozilla – Encrypt keys stored within YAML, JSON, ENV, INI and BINARY files.

Static Analysis

Static Analysis Security Testing (SAST) tools scan software for vulnerabilities without executing the target software. Typically, static analysis will scan the source code for security flaws such as the use of unsafe functions, hard-coded secrets and configuration issues. SAST tools often come in the form of IDE plugins and CLIs that can be integrated into CI/CD pipelines.

Multi-Language Support

  • DevSkimMicrosoft – A set of IDE plugins, CLIs and other tools that provide security analysis for a number of programming languages.
  • GrauditEldar Marcussen – Grep source code for potential security flaws with custom or pre-configured regex signatures.
  • HawkeyeHawkeyesec – Modularised CLI tool for project security, vulnerability and general risk highlighting.
  • LGTMSemmle – Scan and monitor code for security vulnerabilities using custom or built-in CodeQL queries.
  • RIPSRIPS Technologies – Automated static analysis for PHP, Java and Node.js projects.
  • SonarLintSonarSource – An IDE plugin that highlights potential security security issues, code quality issues and bugs.
  • SonarQubeSonarSource – Scan code for security and quality issues with support for a wide variety of languages.

C / C++

  • FlawFinderDavid Wheeler – Scan C / C++ code for potential security weaknesses.


  • Puma ScanPuma Security – A Visual Studio plugin to scan .NET projects for potential security flaws.

Configuration Files

  • ConftestInstrumenta – Create custom tests to scan any configuration file for security flaws.


  • Deep – Static analysis for JVM deployment units including Ear, War, Jar and APK.
  • Find Security BugsOWASP – SpotBugs plugin for security audits of Java web applications. Supports Eclipse, IntelliJ, Android Studio and SonarQube.
  • SpotBugsSpotBugs – Static code analysis for Java applications.


  • ESLintJS Foundation – Linting tool for JavaScript with multiple security linting rules available.



  • Security Code ScanSecurity Code Scan – Static code analysis for C# and VB.NET applications.


  • PhanPhan – Broad static analysis for PHP applications with some support for security scanning features.
  • PHPCS Security AuditFloe – PHP static analysis with rules for PHP, Drupal 7 and PHP related CVEs.
  • ProgpilotDesign Security – Static analysis for PHP source code.


  • BanditPython Code Quality Authority – Find common security vulnerabilities in Python code.


  • BrakemanJustin Collins – Static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
  • DawnScannerPaolo Perego – Security scanning for Ruby scripts and web application. Supports Ruby on Rails, Sinatra and Padrino frameworks.

Threat Modelling

Threat modelling is an engineering exercise that aims to identify threats, vulnerabilities and attack vectors that represent a risk to something of value. Based on this understanding of threats, we can design, implement and validate security controls to mitigate threats. The following list of tools assist the threat modelling process.

  • Awesome Threat ModellingPractical DevSecOps – A curated list of threat modelling resources.
  • SecuriCADForseeti – Treat modelling and attack simulations for IT infrastructure.
  • IriusRiskIriusRisk – Draw threat models and capture threats and countermeasures and manage risk.
  • Raindance ProjectDevSecOps – Use attack maps to identify attack surface and adversary strategies that may lead to compromise.
  • SD ElementsSecurity Compass – Identify and rank threats, generate actionable tasks and track related tickets.
  • Threat DragonOWASP – Threat model diagramming tool.
  • Threat Modelling ToolMicrosoft – Threat model diagramming tool.
  • ThreatspecThreatspec – Define threat modelling as code.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button