DevSecOps CVE Prevention Feasibility Assessment

Research Project: Assessing the effectiveness of open-source DevOps security tools across the entire SDLC by testing their ability to detect/prevent real-world CVEs.

🎯 Project Objective

To answer the critical question: Can security tools effectively catch bugs at different SDLC stages before they become CVEs in production?

This project tests 25+ open-source security tools against 30+ real-world CVEs to determine:

✅ Which tools provide the best CVE prevention coverage
✅ At which SDLC stage vulnerabilities are most effectively caught
✅ What's the optimal minimal viable toolset for different organization sizes
✅ What vulnerability classes still require human review or custom policies

📊 Project Structure

devops_rp/
├── tools/                      # Tool organization by SDLC stage
│   ├── development/           # IDE plugins, linters
│   ├── pre-commit/           # Git hooks, fast scanners
│   ├── ci-cd/                # Pipeline integration
│   ├── pre-deploy/           # Admission control, policies
│   ├── runtime/              # Runtime security
│   └── supporting/           # SBOM, secrets, licenses
│
├── vulnerable-configs/        # Recreated CVE configurations
│   ├── kubernetes/           # K8s CVE configs
│   ├── terraform/            # IaC CVE configs
│   ├── ansible/              # Config management CVEs
│   ├── docker/               # Container CVEs
│   ├── github-actions/       # CI/CD pipeline CVEs
│   └── source-code/          # Application code CVEs
│
├── policies/                  # Custom OPA/Rego policies
│   ├── kubernetes/           # K8s custom policies
│   ├── terraform/            # Terraform policies
│   ├── ansible/              # Ansible policies
│   └── ci-cd/                # CI/CD security policies
│
├── scripts/                   # Automated testing scripts
│   ├── run_development_scan.sh    # Development stage
│   ├── run_precommit_scan.sh      # Pre-commit stage
│   ├── run_cicd_scan.sh           # CI/CD stage
│   ├── run_predeploy_scan.sh      # Pre-deploy stage
│   ├── run_all_stages.sh          # Master orchestration
│   └── verify_tools.sh            # Tool verification
│
├── results/                   # Scan outputs by stage
│   ├── development/
│   ├── pre-commit/
│   ├── ci-cd/
│   ├── pre-deploy/
│   └── aggregated/
│
├── cve_tracking.csv          # Main prevention tracking matrix
├── tools_catalog.csv         # Tool metadata & feasibility scores
└── README.md                 # This file

🛠️ Tool Catalog (25+ Tools)

Development Stage (Shift-Left)

Semgrep - SAST for custom patterns & logic flaws
Bandit - Python security scanning
gosec - Go security analysis
ESLint - JavaScript/TypeScript linting
ShellCheck - Shell script analysis
ansible-lint - Ansible best practices

Pre-Commit Stage (Fast Feedback)

Checkov - IaC security (Terraform, K8s, Docker)
Trivy - Multi-scanner (containers, IaC, secrets)
tfsec - Terraform-specific security
Hadolint - Dockerfile best practices
Gitleaks - Secret detection
detect-secrets - Secret baseline scanning
yamllint - YAML validation

CI/CD Build Stage (Comprehensive)

KICS - Multi-IaC scanning (50+ platforms)
Terrascan - OPA-based IaC policies
Grype - Vulnerability scanning
Syft - SBOM generation
OSV-Scanner - Open Source Vulnerabilities DB
TruffleHog - Deep secret scanning
Kubescape - K8s security posture
Kubesec - K8s manifest scoring
Polaris - K8s best practices validation

Pre-Deploy Stage (Policy Enforcement)

OPA/Conftest - Policy-as-code engine
Datree - K8s policy enforcement
Kyverno - K8s-native policies

Runtime Stage (Production Monitoring)

Falco - Runtime threat detection
OWASP ZAP - Dynamic application security
Nuclei - Template-based vulnerability scanning

🚀 Quick Start

Option A: Docker (Recommended - Zero Installation!)

All 25+ tools pre-packaged in a single container!

# 1. Build the container (one-time, ~5-10 minutes)
./docker-quickstart.sh
# Choose option 1: Build the container image

# 2. Run interactive scanner shell
./docker-quickstart.sh
# Choose option 2: Run interactive shell

# Inside container, run any scan:
./scripts/run_precommit_scan.sh
./scripts/run_all_stages.sh

Or using docker-compose directly:

# Build the image
docker-compose build

# Run interactive shell
docker-compose run --rm devsecops-scanner

# Run all scans (non-interactive)
docker-compose run --rm devsecops-scanner /workspace/scripts/run_all_stages.sh

Benefits:

✅ Zero manual tool installation
✅ Consistent environment across all systems
✅ Reproducible results
✅ No dependency conflicts
✅ Easy to share and distribute

Image Details:

Base: Ubuntu 22.04
Size: ~2-3GB (includes all tools)
Tools: 25+ pre-installed and verified
Mount points: vulnerable-configs/, results/, policies/

Option B: Manual Installation (Native)

If you prefer to install tools directly on your system:

1. Verify Tool Installation

# Check which tools are installed
./scripts/verify_tools.sh

2. Install Missing Tools

Python-based tools:

pip install checkov bandit semgrep ansible-lint detect-secrets yamllint

Binary tools (macOS/Linux via Homebrew):

brew install trivy tfsec hadolint gitleaks shellcheck
brew install kubescape terrascan

Go tools:

go install github.com/securego/gosec/v2/cmd/gosec@latest
go install github.com/trufflesecurity/trufflehog/v3@latest

Container-based tools:

# KICS, Kubesec, etc. run via Docker
docker pull checkmarx/kics

Additional tools:

# Grype & Syft
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh

# OSV-Scanner
go install github.com/google/osv-scanner/cmd/osv-scanner@latest

3. Run Scans

Single stage:

# Development stage (fast, IDE-accessible)
./scripts/run_development_scan.sh

# Pre-commit stage (<30s target)
./scripts/run_precommit_scan.sh

# CI/CD stage (comprehensive, 2-5 min)
./scripts/run_cicd_scan.sh

# Pre-deploy stage (policy enforcement)
./scripts/run_predeploy_scan.sh

All stages:

# Run complete multi-stage analysis
./scripts/run_all_stages.sh

4. Analyze Results

Results are organized by SDLC stage in results/ directory:

# View development stage results
ls -lh results/development/

# View CI/CD stage results
ls -lh results/ci-cd/

# Check aggregated findings
cat results/aggregated/summary.txt

📋 CVE Test Cases

The project includes real-world vulnerable configurations for CVEs including:

High-Priority CVEs (Sample)

CVE ID	Tool/Project	Type	SDLC Catch Stage
CVE-2025-1974	ingress-nginx	K8s Admission Exposure	Pre-Commit, CI/CD, Pre-Deploy
CVE-2024-8775	Ansible	Secret Exposure	Pre-Commit, CI/CD
CVE-2025-13357	Vault TF Provider	LDAP Auth Bypass	Pre-Commit, CI/CD
CVE-2025-49013	GitHub Actions	Script Injection	Pre-Commit, CI/CD
CVE-2024-23652	BuildKit	Path Traversal	Pre-Commit, CI/CD
CVE-2024-21626	runc	Container Escape	CI/CD (scanning), Runtime
CVE-2024-6385	GitLab	Pipeline Execution	Pre-Commit, CI/CD

Full list: See cve_tracking.csv for 30+ CVEs with metadata.

🔬 Testing Methodology

Phase 1: Setup

Install all 25+ security tools across SDLC stages
Create comprehensive CVE catalog with vulnerable versions
Recreate vulnerable configurations for each testable CVE

Phase 2: Execution

Run stage-specific scans (Development → Pre-Commit → CI/CD → Pre-Deploy)
Document detection results for each tool-CVE combination
Measure feasibility metrics (scan time, false positives, complexity)

Phase 3: Analysis

Calculate CVE prevention effectiveness by stage
Identify tool coverage gaps
Create custom policies for undetected CVEs
Generate ROI-based tool recommendations

Phase 4: Reporting

Populate cve_tracking.csv with complete prevention data
Document tool feasibility scores in tools_catalog.csv
Create final feasibility assessment report
Generate implementation roadmap

📊 Expected Deliverables

cve_tracking.csv - Complete prevention effectiveness matrix
- CVE detection by tool and SDLC stage
- Prevention confidence scores
- Integration complexity ratings
tools_catalog.csv - Tool feasibility assessment
- Integration complexity (1-5 scale)
- Scan speed metrics
- False positive rates
- Developer friction scores
- CVE detection coverage percentages
Custom Policies (policies/)
- OPA/Rego policies for tool gaps
- CVE-specific detection rules
- Best practice enforcement
Scan Results (results/)
- Raw tool outputs by SDLC stage
- Aggregated findings
- Performance metrics
Feasibility Report
- Overall CVE prevention statistics
- SDLC stage effectiveness analysis
- Tool ROI rankings
- Recommended minimal viable toolset
- Implementation roadmap by organization size

🎯 Key Research Questions

1. CVE Prevention Coverage

Q: What percentage of CVEs would be caught by standard tools?
Measure: Detection rate across 30+ CVEs

2. SDLC Stage Effectiveness

Q: Which stage catches the most CVEs earliest?
Measure: Prevention by stage (Development, Pre-Commit, CI/CD, Pre-Deploy, Runtime)

3. Tool ROI Analysis

Q: Which tools provide best value (coverage vs. complexity)?
Measure: Detection coverage / (Integration complexity + False positive rate)

4. Gap Identification

Q: What vulnerability classes require custom policies?
Measure: CVEs undetected by any standard tool

5. Practical Adoption

Q: What's the minimal viable toolset?
Measure: Smallest tool combination achieving 80%+ coverage

📈 Sample Scan Output

$ ./scripts/run_all_stages.sh

=========================================
DevSecOps CVE Prevention Assessment
Multi-Stage Security Scanning
=========================================

┌─────────────────────────────────────────┐
│ Stage 1/4: Development Stage            │
└─────────────────────────────────────────┘
[1/7] Running Semgrep (SAST)...
[2/7] Running Bandit (Python)...
...
✅ Development stage scanning complete

┌─────────────────────────────────────────┐
│ Stage 2/4: Pre-Commit Stage             │
└─────────────────────────────────────────┘
[1/7] Running Checkov...
[2/7] Running Trivy...
...
✅ Pre-commit stage scanning complete
⏱️  Scan time: 24s

┌─────────────────────────────────────────┐
│ Stage 3/4: CI/CD Build Stage            │
└─────────────────────────────────────────┘
[1/15] Running Checkov...
[2/15] Running Trivy Config Scanner...
...
✅ CI/CD stage scanning complete
⏱️  Scan time: 3m 42s

┌─────────────────────────────────────────┐
│ Stage 4/4: Pre-Deploy Stage             │
└─────────────────────────────────────────┘
[1/6] Running Conftest (K8s policies)...
...
✅ Pre-deploy stage scanning complete

=========================================
✅ All stages complete!
=========================================
⏱️  Total scan time: 5m 12s
📁 Results: results/
📊 CSV Tracking: cve_tracking.csv
=========================================

🔐 Custom Policy Examples

CVE-2025-1974: Ingress NGINX Admission Exposure

# policies/kubernetes/cve-2025-1974-admission-exposure.rego
package kubernetes.admission.cve_2025_1974

deny[msg] {
    input.kind == "Service"
    contains(lower(input.metadata.name), "admission")
    input.spec.type == "LoadBalancer"
    
    msg := "CVE-2025-1974: Admission controller must not be LoadBalancer type"
}

CVE-2024-8775: Ansible Secret Exposure

# policies/ansible/cve-2024-8775-no-log.rego
package ansible.security.cve_2024_8775

deny[msg] {
    task := input.tasks[_]
    task.include_vars
    not task.no_log == true
    
    msg := "CVE-2024-8775: include_vars without no_log may expose vault secrets"
}

🤝 Contributing

This is a research project. To contribute:

Add new CVE test cases to vulnerable-configs/
Create corresponding OPA policies in policies/
Update cve_tracking.csv with new CVE metadata
Document findings and update feasibility scores

📚 References

📝 License

This project is for research and educational purposes. All CVE data is sourced from public databases (NVD, GitHub Security Advisories, vendor disclosures).

🏁 Next Steps

For Docker Users (Recommended)

✅ Setup Complete - Project structure ready
🔄 Build Container - Run ./docker-quickstart.sh (option 1)
🔄 Add More CVEs - Expand vulnerable-configs with remaining 25+ CVEs
🔄 Run Tests - Use ./docker-quickstart.sh (option 3) or run scans interactively
🔄 Analyze Results - Populate cve_tracking.csv with findings
🔄 Final Report - Generate feasibility assessment and recommendations

For Manual Installation Users

✅ Setup Complete - Project structure and initial tools configured
🔄 Install Tools - Run ./scripts/verify_tools.sh and install missing tools
🔄 Add More CVEs - Expand vulnerable-configs with remaining 25+ CVEs
🔄 Run Tests - Execute ./scripts/run_all_stages.sh
🔄 Analyze Results - Populate cve_tracking.csv with findings
🔄 Final Report - Generate feasibility assessment and recommendations

Project Status: 🏗️ Initial framework complete. Ready for tool installation and CVE expansion.

Last Updated: 2026-01-30

Name		Name	Last commit message	Last commit date
Latest commit History 12 Commits
policies		policies
results		results
scripts		scripts
vulnerable-configs		vulnerable-configs
.dockerignore		.dockerignore
DOCKER_GUIDE.md		DOCKER_GUIDE.md
DOCKER_SUMMARY.md		DOCKER_SUMMARY.md
Dockerfile		Dockerfile
README.md		README.md
build.log		build.log
cve_tracking.csv		cve_tracking.csv
docker-compose.yml		docker-compose.yml
docker-quickstart.sh		docker-quickstart.sh
texput.log		texput.log
tools_catalog.csv		tools_catalog.csv

Folders and files

Latest commit

History

Repository files navigation

DevSecOps CVE Prevention Feasibility Assessment

🎯 Project Objective

📊 Project Structure

🛠️ Tool Catalog (25+ Tools)

Development Stage (Shift-Left)

Pre-Commit Stage (Fast Feedback)

CI/CD Build Stage (Comprehensive)

Pre-Deploy Stage (Policy Enforcement)

Runtime Stage (Production Monitoring)

🚀 Quick Start

Option A: Docker (Recommended - Zero Installation!)

Option B: Manual Installation (Native)

1. Verify Tool Installation

2. Install Missing Tools

3. Run Scans

4. Analyze Results

📋 CVE Test Cases

High-Priority CVEs (Sample)

🔬 Testing Methodology

Phase 1: Setup

Phase 2: Execution

Phase 3: Analysis

Phase 4: Reporting

📊 Expected Deliverables

🎯 Key Research Questions

1. CVE Prevention Coverage

2. SDLC Stage Effectiveness

3. Tool ROI Analysis

4. Gap Identification

5. Practical Adoption

📈 Sample Scan Output

🔐 Custom Policy Examples

CVE-2025-1974: Ingress NGINX Admission Exposure

CVE-2024-8775: Ansible Secret Exposure

🤝 Contributing

📚 References

📝 License

🏁 Next Steps

For Docker Users (Recommended)

For Manual Installation Users

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages