DevSecOps.
Interview cheat sheet.

Master DevSecOps principles and practices for technical interviews, covering shift-left security, CI/CD pipeline integration, SAST/DAST/IAST testing, container security, and cloud-native security. This comprehensive guide provides practical examples, automation strategies, and tool recommendations for building security into the software development lifecycle. Essential for DevSecOps engineers, security architects, and platform engineers working to integrate security throughout the development process.

What is DevSecOps?

• Definition: Integration of security practices within DevOps processes
• Goal: "Shift-left" security - find and fix vulnerabilities early
• Core Principle: Security is everyone's responsibility

DevSecOps vs Traditional Security

Key Benefits

• Faster vulnerability detection
• Reduced security debt
• Improved compliance
• Cost-effective security
• Faster time to market

Pipeline Security Stages

# Example GitLab CI/CD with security stages
stages:
  - build
  - test
  - security-scan
  - deploy

sast:
  stage: security-scan
  script:
    - semgrep --config=auto .
    
dependency-check:
  stage: security-scan
  script:
    - safety check
    - npm audit

Key Security Checkpoints

1. Pre-commit: Secret scanning, linting
2. Build: SAST, dependency scanning
3. Test: DAST, security unit tests
4. Deploy: Configuration validation
5. Runtime: Monitoring, RASP

SAST (Static Application Security Testing)

• Analyzes source code without execution
• Tools: SonarQube, Checkmarx, Fortify

# Example: Bandit for Python
bandit -r ./src -f json -o report.json

DAST (Dynamic Application Security Testing)

• Tests running applications
• Tools: OWASP ZAP, Burp Suite

# Example: OWASP ZAP baseline scan
docker run -t owasp/zap2docker-stable zap-baseline.py \
  -t https://example.com

IAST (Interactive Application Security Testing)

• Combines SAST and DAST
• Real-time analysis during testing
• Tools: Contrast Security, Hdiv Security

SCA (Software Composition Analysis)

• Scans third-party dependencies
• Tools: Snyk, WhiteSource, Black Duck

# Example: npm audit
npm audit --audit-level=moderate
npm audit fix

Docker Security Best Practices

# Good Dockerfile practices
FROM alpine:3.14
RUN addgroup -g 1000 appuser && \
    adduser -D -u 1000 -G appuser appuser
COPY --chown=appuser:appuser app /app
USER appuser
EXPOSE 8080
CMD ["./app"]

Container Scanning

# Trivy container scan
trivy image myapp:latest

# Grype vulnerability scan
grype myapp:latest

Kubernetes Security

# Pod Security Policy example
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny

Terraform Security

# Example: Encrypted S3 bucket
resource "aws_s3_bucket" "secure_bucket" {
  bucket = "my-secure-bucket"
  
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
  
  versioning {
    enabled = true
  }
}

IaC Scanning Tools

• Checkov: Multi-cloud IaC scanner
• Terrascan: Policy as code
• tfsec: Terraform security scanner

# Checkov scan example
checkov -d . --framework terraform

Best Practices

• Never hardcode secrets
• Use secret management tools
• Rotate secrets regularly
• Encrypt secrets at rest and in transit

Tools & Examples

# HashiCorp Vault
vault kv put secret/myapp/db password=mypassword

# AWS Secrets Manager
aws secretsmanager create-secret \
  --name prod/db/password \
  --secret-string "mypassword"

Git Secret Scanning

# Gitleaks example
gitleaks detect --source . -v

# Pre-commit hook
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/sh
gitleaks protect --staged -v
EOF

AWS Security Services

• IAM: Identity and Access Management
• GuardDuty: Threat detection
• Security Hub: Central security view
• WAF: Web Application Firewall

Azure Security

• Azure Security Center: Unified security management
• Key Vault: Secrets management
• Sentinel: SIEM solution

GCP Security

• Cloud IAM: Access control
• Cloud KMS: Key management
• Security Command Center: Security insights

Cloud Security Posture Management (CSPM)

# Example: AWS Config Rule
aws configservice put-config-rule \
  --config-rule file://s3-bucket-public-read-prohibited.json

1. Broken Access Control

   • Implement proper authorization
   • Use principle of least privilege

2. Cryptographic Failures

   • Use strong encryption
   • Proper key management

3. Injection

   # Bad
   query = f"SELECT * FROM users WHERE id = {user_id}"
   
   # Good
   query = "SELECT * FROM users WHERE id = ?"
   cursor.execute(query, (user_id,))
   

4. Insecure Design

   • Threat modeling
   • Security requirements

5. Security Misconfiguration

   • Hardened configurations
   • Remove default accounts

6. Vulnerable Components

   • Regular patching
   • Dependency scanning

7. Authentication Failures

   • MFA implementation
   • Strong password policies

8. Software and Data Integrity

   • Code signing
   • Integrity checks

9. Security Logging Failures

   • Comprehensive logging
   • Log monitoring

10. SSRF (Server-Side Request Forgery)

    • Input validation
    • Network segmentation

Key Metrics

• MTTD: Mean Time To Detect
• MTTR: Mean Time To Respond
• False Positive Rate
• Coverage: % of systems monitored

SIEM Integration

# Example: Send security event to SIEM
import json
import requests

def send_security_event(event_data):
    siem_endpoint = "https://siem.company.com/api/events"
    headers = {"Authorization": "Bearer TOKEN"}
    
    event = {
        "timestamp": "2024-01-01T12:00:00Z",
        "severity": "HIGH",
        "type": "unauthorized_access",
        "details": event_data
    }
    
    response = requests.post(
        siem_endpoint, 
        json=event, 
        headers=headers
    )
    return response.status_code == 200

Categories & Popular Tools

SAST

• SonarQube, Checkmarx, Fortify, Semgrep

DAST

• OWASP ZAP, Burp Suite, Acunetix

Container Security

• Twistlock, Aqua Security, Sysdig

Dependency Scanning

• Snyk, WhiteSource, Dependabot

IaC Security

• Checkov, Terrascan, Open Policy Agent

Secrets Management

• HashiCorp Vault, AWS Secrets Manager, Azure Key Vault

Compliance

• Chef InSpec, Open Policy Agent, Falco

Policy as Code Example

# Open Policy Agent (OPA) example
package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  input.request.object.spec.containers[_].image
  not starts_with(input.request.object.spec.containers[_].image, "registry.company.com/")
  msg := "Images must be from company registry"
}

Security Testing in Code

# Example: Security unit test
import pytest
from security import validate_input

def test_sql_injection_prevention():
    malicious_input = "'; DROP TABLE users; --"
    assert validate_input(malicious_input) == False
    
def test_xss_prevention():
    xss_payload = "<script>alert('XSS')</script>"
    sanitized = sanitize_html(xss_payload)
    assert "<script>" not in sanitized

Common Standards

• PCI DSS: Payment card security
• HIPAA: Healthcare data protection
• SOC 2: Service organization controls
• GDPR: EU data protection
• ISO 27001: Information security

Compliance as Code

# InSpec compliance check
control 'cis-1.1.1' do
  impact 1.0
  title 'Ensure mounting of cramfs filesystems is disabled'
  desc 'The cramfs filesystem type is a compressed read-only Linux filesystem'
  
  describe kernel_module('cramfs') do
    it { should be_disabled }
  end
end

Technical Questions

1. Q: How do you implement shift-left security?

   • A: Integrate security tools in CI/CD, security training for developers, threat modeling early

2. Q: Difference between SAST and DAST?

   • A: SAST analyzes code without running it, DAST tests running applications

3. Q: How to secure containers?

   • A: Minimal base images, non-root users, vulnerability scanning, runtime protection

4. Q: Explain zero-trust architecture

   • A: Never trust, always verify. Micro-segmentation, least privilege, continuous verification

Scenario-Based Questions

1. "How would you secure a CI/CD pipeline?"

   • Implement security gates at each stage
   • Automate security testing
   • Secure credentials with vault
   • Sign artifacts
   • Audit logging

2. "How to handle a security incident?"

   • Detect → Contain → Investigate → Remediate → Document → Improve

Best Practices to Mention

• Automate everything possible
• Security training for all team members
• Regular security assessments
• Incident response planning
• Continuous monitoring
• Regular patching and updates

# Docker security scan
docker scan myimage:tag

# Kubernetes security audit
kubectl audit

# AWS security check
aws securityhub get-findings

# Git secrets check
git secrets --scan

# Dependency check
npm audit
pip-audit
bundler-audit

# Infrastructure scan
terraform plan -out=tfplan
checkov -f tfplan

# Container runtime security
falco -r /etc/falco/rules.yaml

Pre-commit Hook Example

#!/bin/bash
# .git/hooks/pre-commit

# Run security checks
echo "Running security checks..."

# Check for secrets
if ! gitleaks protect --staged -v; then
    echo "Secrets detected! Commit aborted."
    exit 1
fi

# Run SAST
if ! semgrep --config=auto .; then
    echo "Security issues found! Please fix before committing."
    exit 1
fi

echo "Security checks passed!"

Pipeline Security Gate

// Jenkinsfile security stage
stage('Security Scan') {
    parallel {
        stage('SAST') {
            steps {
                sh 'sonar-scanner'
            }
        }
        stage('Dependency Check') {
            steps {
                sh 'safety check'
                sh 'npm audit'
            }
        }
        stage('Container Scan') {
            steps {
                sh 'trivy image ${IMAGE_NAME}'
            }
        }
    }
}

Essential DevSecOps Principles

✓ Shift-left security
✓ Automate security testing
✓ Security as code
✓ Continuous monitoring
✓ Everyone owns security

Security Testing Types

• SAST: Code analysis
• DAST: Runtime testing
• IAST: Interactive testing
• SCA: Dependency scanning
• RASP: Runtime protection

Must-Know Tools

• SAST: SonarQube, Semgrep
• Containers: Trivy, Grype
• IaC: Checkov, tfsec
• Secrets: Vault, Gitleaks
• Monitoring: Falco, SIEM

Interview Success Formula

1. Understand the DevSecOps philosophy
2. Know the tools and when to use them
3. Demonstrate hands-on experience
4. Discuss real-world scenarios
5. Show continuous learning mindset

Remember: DevSecOps is about culture as much as tools. Emphasize collaboration, automation, and continuous improvement in your interviews.