LogoLogo
WebsiteTechnical Discussions
Developer documentation
Developer documentation
  • Public Technical Documentation
    • device-management-service
      • main
        • actor
        • api
        • cmd
          • actor
          • cap
        • db
          • repositories
            • clover
        • dms
          • behaviors
          • jobs
          • node
          • onboarding
          • resources
        • docs
          • deployments
          • onboarding
          • private_network
        • executor
          • docker
          • firecracker
          • background_tasks
          • config
          • hardware
        • maint-scripts
        • network
          • libp2p
        • observability
        • specs
          • basic_controller
          • s3
          • volume
          • integration
        • tokenomics
        • types
        • utils
          • validate
      • release
        • actor
        • api
        • cmd
          • actor
          • cap
        • db
          • repositories
            • clover
        • dms
          • behaviors
          • hardware
          • jobs
          • node
          • onboarding
          • resources
        • docs
          • deployments
          • onboarding
          • private_network
        • executor
          • docker
          • firecracker
        • internal
          • background_tasks
          • config
        • maint-scripts
        • network
          • libp2p
        • observability
        • plugins
        • specs
        • storage
          • basic_controller
          • s3
          • volume
        • test
        • tokenomics
        • types
        • utils
          • validate
    • solutions
      • asi-node
        • main
          • demos
            • ocap_auth
              • ansible
              • videos
          • did-auth-use-scenarios
            • create-a-hosting-deployment
            • make-a-payment
            • manage-dids-and-ocaps
            • register-an-ai-agent
            • submit-a-compute-job
          • pilots
            • asi-create-authentication-poc
        • release
      • nunet-appliance
        • main
        • release
    • test-suite
      • main
        • cicd
          • tests
            • acceptance_tests
            • feature_environment
          • cli
          • dms-on-lxd
            • local
        • environments
          • development
          • feature
          • production
          • staging
        • infrastructure
          • acc-tests-config-maker
          • cloud-init
          • nginx
        • stages
          • dependency_scanning
          • functional_tests
          • integration_tests
          • load_tests
          • regression_tests
          • security_tests_1
          • security_tests_2
          • security_tests_live
          • unit_tests
          • user_acceptance_tests
      • release
        • cicd
          • tests
            • feature_environment
          • cli
          • dms-on-lxd
            • local
        • environments
          • development
          • feature
          • production
          • staging
        • infrastructure
          • cloud-init
          • dms-on-lxd
          • nginx
        • lib
        • stages
          • dependency_scanning
          • functional_tests
          • integration_tests
          • load_tests
          • regression_tests
          • security_tests_1
          • security_tests_2
          • security_tests_live
          • unit_tests
          • user_acceptance_tests
    • team-processes-and-guidelines
      • main
        • best_practices
        • ci_cd_pipeline
        • community_feedback_process
        • contributing_guidelines
        • git_workflows
        • nunet_test_process_and_environments
        • secure_coding_guidelines
        • specification_and_documentation
        • team_process
          • a_project_management
          • b_ceremonies_artifacts
          • c_drum_buffer_rope
          • d_development_process
          • e_culture_rules
          • f_mr_review
        • vulnerability_management
          • devsecops_maturity_models
          • nunet_security_pipeline
          • secret_management
          • sop_security_mr_review
Powered by GitBook
On this page
  • Tl;DR
  • 1. Introduction
  • 2. DevSevOps Maturity Level 2
  • 3. Pipeline Workflow
  • 3.1 Static Analysis Security Testing (SAST)
  • 3.2 Secret Detection
  • 3.3 Dependency Scanning
  • 3.4 Container Scanning
  • 4. Mapping Current Pipeline on Maturity Level 2
Export as PDF
  1. Public Technical Documentation
  2. team-processes-and-guidelines
  3. main
  4. vulnerability_management

nunet_security_pipeline

Previousdevsecops_maturity_modelsNextsecret_management

Last updated 23 hours ago

Last updated: 2025-05-31 01:06:33.261047 File source:

Tl;DR

  • Before diving into this please read:

  • Get yourself familiar with our Vulnerability Management Software:

1. Introduction

This document aims to provide a comprehensive overview of the security pipeline architecture implemented in NuNet. It is designed to serve as an informative guide for developers, and stakeholders involved in the software development and deployment process. The primary focus is to detail the various stages of the pipeline, the security tools integrated at each stage, and the specific roles these tools play in enhancing the security of the software development lifecycle. By outlining the workflow, tool specifics, and the conditions under which the pipeline is triggered.

2. DevSevOps Maturity Level 2

What is at DSOMM Maturity Level 2

After spending a few quarters in level 1, you are now quite familiar with all the tooling that performs scans for you. Furthermore, you have also shared this expertise with other engineers and built up effective team communications to provide you prompt feedback. Now, it’s time to level up.

In level 2, we make informed decisions based on minor tweaks to the default rule sets or configuration. This is mostly to test waters.

Let’s look at what happens on all 4 axes at this level:

  • Static Depth

    • Run SAST scans with minor tweaks to rules.

    • Run SCA scans with minor tweaks to rules.

    • Run Secret scans with minor tweaks to rules.

  • Dynamic Depth

    • Run DAST scans with minor tweaks to baseline settings.

  • Intensity

    • You can now define the frequency of scans to be twice a month.

  • Consolidation

    • You can start adding the findings in a vulnerability register after analysis.

Note: Another important thing to keep in mind at this level is that you are not supposed to fail any builds but you can consult the developers for any concrete findings.

3. Pipeline Workflow

The security tools are applied in different stages of the pipeline workflow. These tools are:

  • Commit

    • Secret Detection

    • Dependency Scanning

    • Coverage Fuzz Testing (Not in use)

  • Build

    • Container Scanning

  • Test

    • API Security (Not in use)

  • Deploy

    • Operational Container Scanning (TBD)

3.1 Static Analysis Security Testing (SAST)

While GitLab's SAST framework supports many programming languages, at NuNet, our primary programming languages are Python, Golang and JavaScript.

This pipeline applies to both container and binary projects.

Tools

Triggers

  • This pipeline is triggered on merge request to every branch.

Stages

It is run on the test (or Security-Test-1) stage.

3.2 Secret Detection

The Secret Detection tool scans repositories to help prevent secrets from being exposed during commits. The primary Secret Detection tool is Gitleaks.

This pipeline applies to both container and binary projects.

Tools

Triggers

This pipeline is triggered on merge request to every branch.

Stages

It is run on the test (or Security-Test-1) stage.

3.3 Dependency Scanning

This stage analyzes an application's dependencies for known vulnerabilities.

Tools

Triggers

This pipeline is currently disabled but can be configured to run every branch commit.

Stages

It is run on the test (or Security-Test-1) stage.

3.4 Container Scanning

The container scanning tool inspects docker images for known vulnerabilities.

Tools

After building the docker image, the following tools scan the built containers.

Triggers

This pipeline is triggered on merge request to every branch.

Stages

This stage is run on the test (or Security-Test-1) stage, primarily after the build stage.

4. Mapping Current Pipeline on Maturity Level 2

  • Static Depth

    • Run SAST scans with minor tweaks to rules. ✅

    • Run SCA scans with minor tweaks to rules. ✅

    • Run Secret scans with minor tweaks to rules. ✅

  • Dynamic Depth

    • Run DAST scans with minor tweaks to baseline settings. (Binary case) ❌

    • Run DAST scans with minor tweaks to baseline settings. (Container Scanning) ✅

  • Intensity

    • Scans to be twice a month. Frequency here is too much, every commit on every branch

  • Consolidation

    • The findings in a vulnerability register after analysis. Vulnerability Management Process designed for this purpose

(TBD)

is used for secret detection in repositories.

The primary tool for scanning application dependencies is .

(Default Gitlab container scanner)

Static Analysis Security Testing (SAST)
IaC Best Practices
Dynamic Application Security Testing (DAST)
Gitleaks
Gemnasium
Trivy
DockerBench
ClairScan
link on GitLab
DevSecOps Maturity Models
DefectDojo
Reference Pipeline