Brian Green greenbrian

DevSecOps Maturity Model

DevSecOps has finally become popular within the wider IT industry in 2019. I started as a web developer in 2001, learned about testing automation, system deployment automation, and "infrastructure as code" in 2012, when DevOps was becoming a popular term. DevOps became common after the release of The Phoenix Project in Jan 2013. It has taken 7+ years for security to become integrated within the DevOps methodology. The following is a list of concepts I go through with project owners, project managers, operations, developers, and security teams, to help establish how mature their DevOps and security automation is, and to help them increase that maturity over time. This model is based on experience consulting with a variety of US Financial, Healthcare, and Department of Defense, organizations, and combines:

PCI DSS
NYDFS
[HITRUST CSF](https://hitrustalliance.net/product-tool/hitrus

get_enterprise_url.py

Gets download URLs for Vault Enterprise and Consul Enterprise

Prerequisites:

Semver is the only external dependency. pip install semver

Usage:

python get_enterprise_url.py -h will display all flags and options.

vault_aws_auth

These are python 2 and 3 snippets showing how to generate headers to authenticate with HashiCorp's Vault using the AWS authentication method. There's also a Ruby implementation which uses version 3 of the AWS SDK for Ruby.

The python scripts look for credentials in the default boto3 locations; if you need to supply custom credentials (such as from an AssumeRole call), you would use the botocore.session.set_credentials method before calling create_client.

NOTE - An updated and more complete example can be found here.

Bootstrapping Consul Servers with Version 8 ACLs Enabled (v0.8.x)

Start a new Consul server

Here's acl.json:

Currently, there is an explosion of tools that aim to manage secrets for automated, cloud native infrastructure management. Daniel Somerfield did some work classifying the various approaches, but (as far as I know) no one has made a recent effort to summarize the various tools.

This is an attempt to give a quick overview of what can be found out there. The list is alphabetical. There will be tools that are missing, and some of the facts might be wrong--I welcome your corrections. For the purpose, I can be reached via @maxvt on Twitter, or just leave me a comment here.

There is a companion feature matrix of various tools. Comments are welcome in the same manner.

I have spent quite a bit of time figuring out automounts of NFS shares in OS X...

Somewhere along the line, Apple decided allowing mounts directly into /Volumes should not be possible:

/etc/auto_master (see last line):

#
# Automounter master map
#

+auto_master # Use directory service

303 See Other

Location: https://github.com/wsargent/docker-cheat-sheet

Hi there!

The docker cheat sheet has moved to a Github project under https://github.com/wsargent/docker-cheat-sheet.

Please click on the link above to go to the cheat sheet.

	resource "aws_security_group" "sg" {
	vpc_id = "${var.vpc}"
	name = "${var.name}"
	description = "${var.description}"
	tags = "${merge(var.tags, map("Name", format("%s", var.name)))}"
	}

	resource "aws_security_group_rule" "sg_rule_sg_ids" {
	count = "${length(var.inbound_sources) * (var.add_rules ? 1 : 0)}"
	type = "${var.type}"

	#### first class expresssion
	variable "ami" {}
	resource "aws_instance" "example" {
	ami = var.ami
	}

	#### list & map
	resource "aws_instance" "example" {
	vpc_security_group_ids = var.security_group_id != "" ? [var.security_group_id] : []
	}

	---
	# This has been tested with ansible 1.3 with these commands:
	# ansible-playbook -i hosts ansible_conditionals_examples.yaml --extra-vars="hosts=myhosts isFirstRun=false"
	# ansible-playbook -i hosts ansible_conditionals_examples.yaml --extra-vars="hosts=myhosts isFirstRun=true"
	# ansible-playbook -i hosts ansible_conditionals_examples.yaml --extra-vars="hosts=myhosts"
	# NB: The type of the variable is crucial!

	- name: Ansible Conditionals Examples
	hosts: $hosts
	vars_files: