# Shift security left
# Automate security checks in CI/CD
# Scan code, dependencies, containers, infrastructure
# Monitor and respond to security incidents
# Maintain compliance and audit trails

┌─────────────────────────────────────────────────────────┐
│                    SECURE SDLC                          │
└─────────────────────────────────────────────────────────┘

1. PLAN & DESIGN
   ├── Threat modeling
   ├── Security requirements
   └── Architecture security review

2. DEVELOP
   ├── Secure coding guidelines
   ├── IDE security plugins
   ├── Pre-commit hooks (secret scanning)
   └── Security-focused code reviews

3. BUILD
   ├── SAST (static code analysis)
   ├── SCA (dependency scanning)
   ├── Container image scanning
   └── IaC security scanning

4. TEST
   ├── DAST (dynamic testing)
   ├── API security testing
   ├── Penetration testing
   └── Security regression testing

5. DEPLOY
   ├── Container runtime security
   ├── Infrastructure security validation
   ├── Secrets injection
   └── Security configuration checks

6. OPERATE
   ├── Runtime monitoring
   ├── Vulnerability management
   ├── Incident response
   └── Compliance monitoring

7. MONITOR
   ├── Security logging
   ├── Threat detection
   ├── Anomaly detection
   └── Security metrics

# Example: Security-Integrated Pipeline

stages:
  - security-scan
  - build
  - test
  - security-test
  - deploy

# Stage 1: Pre-build Security
security-scan:
  stage: security-scan
  script:
    # Secret scanning
    - trufflehog --regex --entropy=False .
    # SAST scanning
    - semgrep --config=auto --sarif > sast-results.sarif
    # Dependency scanning
    - snyk test --severity-threshold=high
    # IaC scanning
    - checkov -d . --framework terraform
  artifacts:
    reports:
      sast: sast-results.sarif

# Stage 2: Build with security
build:
  stage: build
  script:
    - docker build -t myapp:$CI_COMMIT_SHA .
    # Sign container image
    - cosign sign myapp:$CI_COMMIT_SHA

# Stage 3: Container scanning
container-scan:
  stage: test
  script:
    - trivy image --severity HIGH,CRITICAL myapp:$CI_COMMIT_SHA
    - docker scan myapp:$CI_COMMIT_SHA
  allow_failure: false  # Break build on critical issues

# Stage 4: Dynamic security testing
dast:
  stage: security-test
  script:
    # Deploy to staging
    - kubectl apply -f k8s/staging/
    # Run DAST
    - zap-baseline.py -t https://staging.example.com
    # API security test
    - postman collection run security-tests.json

# Stage 5: Deploy with security
deploy:
  stage: deploy
  script:
    # Verify image signature
    - cosign verify myapp:$CI_COMMIT_SHA
    # Apply security policies
    - kubectl apply -f k8s/policies/
    # Deploy application
    - kubectl apply -f k8s/production/
    # Verify deployment security
    - kube-bench run --targets master,node

1. DISCOVERY
   └── Scan code, dependencies, containers, infrastructure
   
2. PRIORITIZATION
   ├── Severity assessment (CVSS score)
   ├── Exploitability analysis
   ├── Business impact evaluation
   └── Risk scoring
   
3. TRIAGE
   ├── Assign ownership
   ├── Set SLA based on severity
   ├── Create remediation tickets
   └── Track in vulnerability management system
   
4. REMEDIATION
   ├── Update dependencies
   ├── Apply patches
   ├── Implement workarounds
   └── Verify fixes
   
5. VALIDATION
   ├── Re-scan to confirm fix
   ├── Test for regressions
   └── Close vulnerability ticket
   
6. REPORTING
   ├── Update security dashboard
   ├── Notify stakeholders
   └── Document lessons learned

Layer 1: Network Security
├── Firewall rules
├── Network segmentation
├── DDoS protection
└── WAF (Web Application Firewall)

Layer 2: Application Security
├── Input validation
├── Output encoding
├── Authentication & authorization
└── Session management

Layer 3: Data Security
├── Encryption at rest
├── Encryption in transit
├── Data masking
└── Access controls

Layer 4: Infrastructure Security
├── OS hardening
├── Patch management
├── Security configuration
└── Vulnerability scanning

Layer 5: Monitoring & Response
├── Security logging
├── SIEM
├── Incident response
└── Threat intelligence

1. VERIFY EXPLICITLY
   ├── Authenticate every request
   ├── Authorize based on all data points
   └── Use multi-factor authentication

2. LEAST PRIVILEGE ACCESS
   ├── Just-in-time access
   ├── Risk-based adaptive policies
   └── Data protection

3. ASSUME BREACH
   ├── Minimize blast radius
   ├── Segment access
   ├── End-to-end encryption
   └── Analytics for visibility

# Dependency scanning
npm audit
snyk test

# SAST scanning
eslint --plugin security
semgrep --config=p/react

# Content Security Policy
# Add to HTML or headers
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

// ✅ GOOD: Sanitize user input
import DOMPurify from 'dompurify';

const SafeComponent: React.FC<{html: string}> = ({html}) => {
  const sanitized = DOMPurify.sanitize(html);
  return <div dangerouslySetInnerHTML={{__html: sanitized}} />;
};

// ❌ BAD: Direct use of dangerouslySetInnerHTML
const UnsafeComponent = ({html}) => (
  <div dangerouslySetInnerHTML={{__html: html}} />
);

// ✅ GOOD: Secure token storage
// Store JWT in httpOnly cookie, not localStorage
// Use secure, sameSite=strict cookies

// ❌ BAD: Storing tokens in localStorage
localStorage.setItem('token', jwt);  // Vulnerable to XSS

# Dependency scanning
safety check
pip-audit
snyk test --file=requirements.txt

# SAST scanning
bandit -r .
semgrep --config=p/python

# Secret scanning
detect-secrets scan

# ✅ GOOD: Use parameterized queries
from sqlalchemy import text

def get_user(user_id: int):
    query = text("SELECT * FROM users WHERE id = :id")
    result = db.execute(query, {"id": user_id})
    return result.first()

# ❌ BAD: String concatenation (SQL injection)
def get_user_unsafe(user_id: str):
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return db.execute(query)

# ✅ GOOD: Input validation
from pydantic import BaseModel, validator

class UserCreate(BaseModel):
    email: str
    password: str
    
    @validator('password')
    def validate_password(cls, v):
        if len(v) < 8:
            raise ValueError('Password must be at least 8 characters')
        return v

# ✅ GOOD: Rate limiting
from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@app.post("/api/login")
@limiter.limit("5/minute")
async def login(credentials: LoginRequest):
    return await authenticate(credentials)

# Dependency scanning
mvn dependency-check:check
snyk test

# SAST scanning
spotbugs -effort:max -low
semgrep --config=p/java

# Container scanning
trivy image myapp:latest

// ✅ GOOD: Use prepared statements
public User getUserById(int userId) {
    String sql = "SELECT * FROM users WHERE id = ?";
    return jdbcTemplate.queryForObject(sql, new Object[]{userId}, 
                                      new UserRowMapper());
}

// ❌ BAD: String concatenation
public User getUserByIdUnsafe(int userId) {
    String sql = "SELECT * FROM users WHERE id = " + userId;
    return jdbcTemplate.queryForObject(sql, new UserRowMapper());
}

// ✅ GOOD: Spring Security configuration
@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .and()
            .authorizeRequests()
                .antMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            .and()
            .oauth2ResourceServer().jwt();
        return http.build();
    }
}

// ✅ GOOD: Secure password hashing
@Service
public class PasswordService {
    private final PasswordEncoder encoder = new BCryptPasswordEncoder(12);
    
    public String hashPassword(String plainPassword) {
        return encoder.encode(plainPassword);
    }
}

# Container scanning
trivy image nginx:latest
docker scan nginx:latest
grype nginx:latest

# K8s security scanning
kubesec scan pod.yaml
kube-bench
kube-hunter

# Policy enforcement
kubectl apply -f pod-security-policy.yaml
gatekeeper install

# ✅ GOOD: Secure Pod configuration
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
    resources:
      limits:
        cpu: "1"
        memory: "512Mi"
      requests:
        cpu: "0.5"
        memory: "256Mi"
    livenessProbe:
      httpGet:
        path: /health
        port: 8080
    readinessProbe:
      httpGet:
        path: /ready
        port: 8080

# ✅ GOOD: Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432

name: Security Pipeline

on: [push, pull_request]

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: TruffleHog Secret Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/secrets
            p/owasp-top-ten
      - name: Run CodeQL
        uses: github/codeql-action/analyze@v2

  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
      - name: Upload results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

  iac-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: infrastructure/
          framework: terraform
          output_format: sarif
          output_file_path: checkov-results.sarif

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/DAST.gitlab-ci.yml

variables:
  SECURE_LOG_LEVEL: "debug"

stages:
  - test
  - security
  - deploy

security-scan:
  stage: security
  image: securego/gosec:latest
  script:
    - gosec -fmt json -out gosec-report.json ./...
  artifacts:
    reports:
      sast: gosec-report.json

custom-container-scan:
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

CC6.1: Logical and Physical Access Controls
├── Multi-factor authentication
├── Password policies
├── Access reviews (quarterly)
└── Privileged access management

CC6.2: System Monitoring
├── Security logging enabled
├── Log retention (1 year)
├── SIEM implementation
└── Anomaly detection

CC7.1: Threat Detection
├── Vulnerability scanning (weekly)
├── Penetration testing (annual)
├── Security awareness training
└── Incident response plan

CC7.2: Infrastructure Security
├── Network segmentation
├── Encryption at rest and in transit
├── Patch management
└── Configuration management

Requirement 1: Firewall Configuration
├── Network diagram documentation
├── Firewall rule reviews (6 months)
└── DMZ implementation

Requirement 2: System Security
├── Change default passwords
├── Disable unnecessary services
└── Security configuration standards

Requirement 3: Protect Cardholder Data
├── Data encryption
├── Minimize data retention
└── Secure key management

Requirement 6: Secure Development
├── Security training for developers
├── SAST/DAST scanning
├── Code review process
└── Vulnerability management

Requirement 10: Logging and Monitoring
├── Audit trails
├── Log review
├── Time synchronization
└── Log protection

Requirement 11: Security Testing
├── Quarterly vulnerability scans
├── Annual penetration testing
├── IDS/IPS deployment
└── File integrity monitoring

1. VULNERABILITY METRICS
   ├── Mean Time to Detect (MTTD): < 24 hours
   ├── Mean Time to Remediate (MTTR): < 30 days (critical), < 90 days (high)
   ├── Vulnerability density: # of vulnerabilities per 1000 lines of code
   └── False positive rate: < 10%

2. SECURITY TESTING COVERAGE
   ├── Code coverage by SAST: > 80%
   ├── API endpoints covered by DAST: > 90%
   ├── Dependencies scanned: 100%
   └── Containers scanned: 100%

3. PIPELINE SECURITY
   ├── Security gate failures: Track trend
   ├── Time added by security scans: < 10% of total build time
   ├── Security exceptions granted: < 5% of findings
   └── Pipeline security incidents: 0

4. INCIDENT RESPONSE
   ├── Security incidents: Track count and trend
   ├── Incident response time: < 1 hour
   ├── Incident resolution time: Based on severity
   └── Post-incident reviews completed: 100%

5. COMPLIANCE
   ├── Policy compliance rate: > 95%
   ├── Audit findings: Track and trend
   ├── Training completion: 100% annually
   └── Access reviews completed: 100% quarterly

┌─────────────────────────────────────────────┐
│         SECURITY DASHBOARD                  │
├─────────────────────────────────────────────┤
│ Vulnerability Status                        │
│ ┌─────────────────────────────────────────┐ │
│ │ Critical:  3  ⚠️  (↓ 2 from last week) │ │
│ │ High:     12  ⚠️  (↑ 3 from last week) │ │
│ │ Medium:   45  ℹ️                        │ │
│ │ Low:     128  ℹ️                        │ │
│ └─────────────────────────────────────────┘ │
│                                             │
│ Mean Time to Remediate                      │
│ ┌─────────────────────────────────────────┐ │
│ │ Critical: 5 days  ✅ (Target: < 7)     │ │
│ │ High:    18 days  ✅ (Target: < 30)    │ │
│ │ Medium:  45 days  ⚠️  (Target: < 60)   │ │
│ └─────────────────────────────────────────┘ │
│                                             │
│ Security Scan Coverage                      │
│ ┌─────────────────────────────────────────┐ │
│ │ SAST:  87% ✅                           │ │
│ │ SCA:   100% ✅                          │ │
│ │ DAST:  75% ⚠️                           │ │
│ │ Container: 100% ✅                      │ │
│ └─────────────────────────────────────────┘ │
└─────────────────────────────────────────────┘

Prevention:
- Implement proper authorization checks
- Deny by default
- Test access controls thoroughly
- Log access control failures

Prevention:
- Use strong encryption (AES-256, RSA-2048+)
- Implement TLS 1.3
- Secure key management
- Don't store sensitive data unnecessarily

Prevention:
- Use parameterized queries
- Validate and sanitize input
- Use ORM frameworks
- Implement WAF

Prevention:
- Threat modeling
- Secure design patterns
- Security requirements in user stories
- Security architecture review

Prevention:
- Automated configuration management
- Remove default credentials
- Disable unnecessary features
- Regular security audits

Prevention:
- Dependency scanning
- Regular updates
- Remove unused dependencies
- Monitor CVE databases

Prevention:
- Multi-factor authentication
- Strong password policies
- Session management
- Rate limiting

Prevention:
- Digital signatures
- Verify integrity of updates
- Secure CI/CD pipeline
- Supply chain security

Prevention:
- Comprehensive logging
- Real-time monitoring
- Automated alerting
- Log protection

Prevention:
- Input validation
- Network segmentation
- Whitelist allowed destinations
- Disable unused URL schemas

# .github/workflows/security.yml
name: Security Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 0 * * 0'  # Weekly scan

jobs:
  secret-scanning:
    name: Secret Detection
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Gitleaks Scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dependency-scanning:
    name: Dependency Vulnerabilities
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install safety pip-audit
      - name: Safety Check
        run: safety check --json > safety-report.json
        continue-on-error: true
      - name: Pip Audit
        run: pip-audit --format json > pip-audit-report.json
      - name: Snyk Test
        uses: snyk/actions/python@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  sast-scanning:
    name: Static Code Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Bandit Security Scan
        run: |
          pip install bandit[toml]
          bandit -r . -f json -o bandit-report.json
      - name: Semgrep Scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/python
            p/owasp-top-ten
            p/security-audit

  container-scanning:
    name: Container Security
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Build Docker Image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Trivy Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
      - name: Grype Scan
        uses: anchore/scan-action@v3
        with:
          image: myapp:${{ github.sha }}
          fail-build: true
          severity-cutoff: high

  api-security-testing:
    name: DAST - API Security
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Start Application
        run: |
          docker-compose up -d
          sleep 10
      - name: OWASP ZAP API Scan
        uses: zaproxy/action-api-scan@v0.4.0
        with:
          target: 'http://localhost:8000/openapi.json'
          fail_action: true
      - name: Stop Application
        run: docker-compose down

  security-report:
    name: Generate Security Report
    needs: [secret-scanning, dependency-scanning, sast-scanning, container-scanning]
    runs-on: ubuntu-latest
    steps:
      - name: Collect Results
        run: echo "Security scans completed"
      - name: Post to Slack
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "Security scan completed for ${{ github.repository }}"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}