91��ɫ

A DevSecOps pipeline integrates development, security, and operations together to help teams release high-quality software as quickly and efficiently as possible. Achieving such a tightly integrated pipeline requires various tools to automate processes and facilitate collaboration. Organizations may use paid tools with enterprise licensing, which usually includes support and SLAs but comes with a higher price tag. Another option is to use open-source tools developed and maintained by an open community of professional developers. They are usually free or relatively inexpensive.

This blog lists popular, high-quality DevSecOps open source tools that deliver the functionality to develop, run, and secure applications.

A Guide to DevSecOps Open-Source Tools

The tools on this list fall into several categories:

DevSecOps Open Source Tools

Container Management ��>>

Source Control ��>>

Continuous Integration/Continuous Delivery ��>>

Monitoring and Metrics ��>>

Infrastructure as Code (IaC) ��>>

Code Scanning ��>>

Threat Intelligence ��>>

Security Testing ��>>

����DzԳٲ����Ա����

Containers are small, self-contained runtime environments for microservices applications. The following DevSecOps open source tools are used to build and manage containers.

Docker

is an open-source software platform used to build, ship, and manage containerized applications. Docker led the containerization revolution and is now so ubiquitous that “Docker” and “containers” are almost synonyms. Docker simplifies container creation and management and provides an API to enable automation and orchestration. It’s also vendor-neutral and capable of running on any operating system or major cloud platform.

Kubernetes

is another ubiquitous name in container management. Kubernetes is an open-source container orchestration platform that automates container creation, deployment, management, and scaling. Containers can be managed manually in small deployments, but larger and more complex environments require automation for efficient and error-free management. Kubernetes lets you automatically ship, control, repair, and scale containerized applications for streamlined and error-free deployments.

Istio

is an open-source service mesh for containerized microservices applications. A service mesh handles communications between the individual microservices, using proxies to abstract network logic – such as security, encryption, and observability – to a common control plane. This feature is how Istio gives engineers a way to efficiently handle networking for dozens or hundreds of microservices from one platform. Istio is built on the Envoy open source edge and service proxy, which gives it access to additional plugins and features.

��Source Control

Source control, a.k.a. version control, tracks code changes and helps resolve conflicts when changes are merged from multiple sources.

Git

is the de facto standard for open-source version control. Git stores source code and its change history in a central repository, allowing developers to create branches which are worked in parallel to the main version. Changes are committed to the branch, and then the branch is merged back into the main version. This facilitates simultaneous collaboration on the same project and allows teams to track changes and rollback when needed. Since Git is so popular, it can be used with a wide variety of development tools and environments.

�����/���

Continuous integration/continuous delivery, or CI/CD, uses automated integration and delivery tools which enable these processes to run continuously, creating a more streamlined development pipeline. These DevSecOps open source tools provide automation capabilities for CI/CD.

Argo CD

is an open source, declarative, GitOps continuous delivery tool for Kubernetes. Argo CD pulls updates from Git source code repositories and deploys it directly to Kubernetes resources, enabling truly continuous delivery in cloud-native Kubernetes environments. It gives developers the ability to manage infrastructure configurations and application code in one system, and its declarative pipelines make it easy to have your pipeline configurations inside Git version control.

GitLab

is an open source, cloud-based Git source control repository with built-in CI/CD tools. GitLab supports continuous integration of code changes through scripts that build and test code automatically. Continuous delivery tools automatically verify code before allowing developers to manually trigger deployments. The benefit of GitLab is that everything you need for CI/CD is built into the platform, reducing the need for third-party integrations.

Jenkins

is an open source automation server that includes hundreds of plugins to automate CI/CD processes. This makes Jenkins incredibly flexible, as you can choose the exact tools and functionalities you need to support your project. On the other hand, managing all your plugins will grow increasingly difficult as the project scales up.

��Monitoring and Metrics

Monitoring and metrics solutions analyze application and pipeline data to track performance and alert engineers to issues. Open source monitoring and metrics tools for DevSecOps include:

Prometheus

is an open source monitoring solution hosted by the . Prometheus scrapes HTTP endpoints to collect time-series metrics and generates dashboards with visualizations and deep querying capabilities. It supports multi-dimensional data collection and querying, which is particularly useful for microservices application architectures.

The Elastic Stack

– formerly known as the ELK Stack – is a combination of open source projects maintained by Elastic. It includes:

• Elasticsearch: Search and analytics engine.
• Logstash: Data processing pipeline which transforms data and loads it into Elasticsearch.
• Kibana: Visualizations of data in Elasticsearch with charts and graphs.
• Beats: Lightweight, single-purpose data shippers.

It’s important to note that, as of 2021, Elasticsearch and Kibana are no longer open-source, as Elastic switched to dual licensing (Elastic License and SSPL), which are not approved by the Open Source Initiative (OSI). However, the projects are still free to use, the source code is available to the public, and Elastic accepts community contributions.

�� Infrastructure as Code (IaC)

Infrastructure as Code (IaC) turns infrastructure configurations into software code decoupled from the underlying hardware. Open source DevSecOps tools for IaC include:

Terraform

is an open source IaC tool created by HashiCorp. It uses declarative programming to automatically provision, update, and manage IaC infrastructure in on-premises, cloud, and SaaS deployments. Terraform can also be used to provision and manage serverless functions and Kubernetes clusters.

Configuration Management

Configuration management involves continuously monitoring existing IaC configs to prevent systems from drifting from a tested, secure state. Open source configuration management tools for DevSecOps include:

Chef Infra

is an open source automated IaC configuration management solution. Automated configuration management tools allow administrators to define the desired state of a system and then continuously monitor systems to ensure they don’t drift away from that state. Chef uses “recipes,” automated playbooks that carry out imperative programming instructions for configurations.

Ansible

is an open source project sponsored by Red Hat which automates configuration management as well as cloud provisioning, networking, deployment, and other IaC tasks. Ansible uses declarative playbooks, which means it doesn’t need specific instructions for how to deploy or maintain configurations – you simply define the desired state, and Ansible determines the best way to achieve and maintain that state.

�� ��Code Scanning and Remediation

Automatic code scanning tools analyze every line of code to search for security defects and vulnerabilities, making them a critical component of DevSecOps pipelines. The follow open source tools provide automatic code scanning capabilities, with some offering automatic defect remediation as well.

GitLab

As part of their automated continuous integration toolset, the GitLab platform includes automatic security scanning functionality embedded in their Git source code repository. This makes GitLab a convenient choice for a fully integrated DevSecOps development solution.

OWASP

The provides a variety of free and open source resources, tools, and technologies for web application security. There are two OWASP code scanning tools that are particularly useful for DevSecOps pipelines:

• provides automated code reviews, vulnerability assessments, penetration testing, and runtime testing.
• is a Software Composition Analysis (SCA) tool which scans a project’s dependencies for known vulnerabilities.

Snyk

is an open source code scanning and defect remediation tool. Snyk is a “developer first” solution that helps developers find, prioritize, and fix defect and vulnerabilities in open source dependencies. It includes continuous, automatic code scanning for security vulnerabilities and compliance issues and one-click pull requests for automated fixes.

��Threat Intelligence

Threat intelligence is the ability to identify, predict, and define threats. It’s an important DevSecOps tool because it provides the information needed to develop software around the “security by design” principle.

OWASP Threat Dragon

is another open source tool from OWASP. Threat Dragon creates threat model diagrams that record potential threats and determine how to mitigate them. It also provides visualizations of threat model components and threat surfaces.

��Security Testing

Security testing is used to test applications and APIs from an outside perspective without accessing the underlying source code. DevSecOps open source tools for security testing include:

BDD-Security

is an open source framework that leverages tools like OWASP ZAP to provide security testing based on the Behavior Driven Development (BDD) concept. BDD uses real-world examples (how people actually use an application) to illustrate how a system should behave. BDD-Security uses this concept to create self-verifying security specifications to automatically test applications.

Chef Inspec

is an open-source framework for testing applications and infrastructure. The desired state of a system is expressed in Chef InSpec code, which is then compared to the actual state, detecting violations and reporting the results. Chef InSpec also includes automated security compliance audits to prevent regulatory issues.

91��ɫ Supports DevSecOps Transformation

These DevSecOps open source tools make it easier for teams to collaborate and release secure, high-quality applications. However, implementing new DevSecOps tools and processes can be challenging. First, you need to know what your current security posture is so you can choose the right tools to get you to where you need to be. In addition, your people need training on how to use these tools properly and additional support as they adjust to new workflows. The DevSecOps experts at are here to support your organization through DevSecOps implementation so you can achieve your goals faster.

For more help with DevSecOps open source tools, contact 91��ɫ Strategic Services.

"91��ɫ is the leading DevOps platform enabling the world’s largest digital transformations on Salesforce. 91��ɫ accelerates Salesforce deployments, simplifies the release process, increases developer productivity and maximizes return on cloud investments.

More than 500 of the world’s largest digitally transformed companies run on 91��ɫ including Boston Scientific, Coca-Cola, Fair Trade, Linde, MassMutual, Schneider Electric and Shell. 91��ɫ processes over 50 million DevOps transactions per month and is rated with a 100% score on the Salesforce AppExchange."

‍