Abhay Bhargav Profile picture
Mar 21 β€’ 7 tweets β€’ 8 min read
IMO #DevSecOps has a close-knit relationship with #ZeroTrust. Let's dive in with a 🧡
I've already tried to cover ZeroTrust as a summary here πŸ‘‡2/
The way I see it, both the identity and policy aspects of ZeroTrust require/can do with a solid "shift left" approach of being able to incorporate identity and policy checks in the build/deployment flows. 3/
In fact with @OpenPolicyAgent and @osoHQ unit-tests, it becomes even easier and wayy more powerful to have super-granular authZ and policy testing early in the cycle, even in each build, etc.
Oso unit-test: docs.osohq.com/guides/more/te…
OPA unit tests: openpolicyagent.org/docs/latest/po…
@OpenPolicyAgent @osoHQ This can be extended across the stack, think...
@kubernetesio authZ and policy testing with native tools, @kyverno, etc perhaps triggered as @argoproj workflows
Cloud IAM tests for things like SCPs, Permission boundaries ( @awscloud ) and similar for other cloud providers
@OpenPolicyAgent @osoHQ @kubernetesio @kyverno @argoproj @awscloud Network security policy testing with @ciliumproject, @projectcalico, etc.
I am just spitballing here, but there's a great deal of (unexplored) areas that can bring the best of #DevSecOps and #ZeroTrust together. Any other areas that you can think of?
@OpenPolicyAgent @osoHQ @kubernetesio @kyverno @argoproj @awscloud @ciliumproject @projectcalico That's a wrap!

If you enjoyed this thread:

1. Follow me @abhaybhargav for more of these
2. RT the tweet below to share this thread with your audience

β€’ β€’ β€’

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Abhay Bhargav

Abhay Bhargav Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @abhaybhargav

Mar 23
#SSRF is a super popular vulnerability that is leveraged extensively, by bad actors. Let's look at SSRF defense in this 🧡 1/
Let's start with the basics. SSRF happens because your app makes requests to other URLs based on user-generated data. If your app doesnt need to redirect/request random URLs (functionality), ensure that you have a tight allowlist. Only redirect to URLs in the allowlist 2/
But if your app needs to redirect to a larger (purely user-defined) set of URLs, then things may get a little more complex. Now you need to validate inputs like a mf'er. Parse and Break down URLs by scheme, domain, etc. Validate each one as required 3/ Image
Read 10 tweets
Mar 15
Realized that there's a huge gap in knowledge for some taxonomy and terms in #infosec. Here's a 🧡
Let's start with CWE from @CweCapec. Common Weakness Enumeration.
* This is 🚫 a scoring system
* This is identifier for a type of vuln
For example: SQL Injection is CWE 89
It has broad "parent" and more specific "child" categories. But EOD, they are Vulnerability IDs 2/
@CweCapec Let's look the one its most confused with. CVE (@CVEnew). This is a number that is assigned to a specific vulnerability identified against software/hardware that is publicly available (commerical/OSS). Ex: CVE-2022-0847 is a CVE given to the Linux #DirtyPipe vul. 3/
Read 10 tweets
Dec 10, 2021
ICYMI, this is how the #log4j #Log4Shell flaw works (in simple english), a 🧡
1. Victim is running a Java Web that uses the log4j logging lib
2. The victim web app has code that logs http request payloads/headers with log statements (example User-Agent)
1/ Image
3. Attacker identifies vulnerable app and makes a request to the server with the User-Agent Value set to this. What does this mean? 2/ Image
jndi == Java Naming and Directory Interface. Allows Java apps to access multiple apis for LDAP, Remote Method Invocation (RMI), etc through the JNDI Interface
4. The attacker tries to get the log4j library to lookup an LDAP server through JNDI 3/
Read 9 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!