Skip to content

Commit 4fe0486

Browse files
wurstbrotwurstbrot
committed
Enhance documentation
1 parent 2d92e99 commit 4fe0486

4 files changed

Lines changed: 74 additions & 2 deletions

File tree

‎README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,58 @@ Create issues or even better Pull Requests in [github](https://github.com/wurstb
3030
* [Security in DevOps-Strategies](https://www.youtube.com/watch?v=gWjGWebWahE&t=448s), 28.09.2017, Hamburg, Germany
3131
* [DevSecOps Maturity Model](https://docs.google.com/presentation/d/1rrbyXqxy3LXAJNPFrVH99mj_BNaJKymMsXZItYArWEM/edit?usp=sharing), 2017
3232

33+
# Assessment
34+
In case you would like to perform a DevSecOps assessment, the following tools are available:
35+
* Usage of the applicaton in a `container`.
36+
* Development of an export to (OWASP Maturity Models)[https://github.com/OWASP/Maturity-Models] (recommended for assessments with a lot of teams)
37+
* Creation of your excel sheet (not recommended, you want to use DevOps, don't even try!)
38+
39+
## Container
40+
1. Install [Docker](https://www.docker.com)
41+
2. Run `docker run --rm -p 8080:80 wurstbrot/dsomm:latest
42+
3. Browse to <http://localhost:8080> (on macOS and Windows browse to <http://192.168.99.100:8080> if you are using docker-machine instead
43+
of the native docker installation)
44+
45+
In case you would like to have perform an assessment for multiple teams, iterate from port 8080 to 8XXX, depending of the size of your team.
46+
In case the application should be visible, but the "Implementation Level" shouldn't be changeable, consider the following code:
47+
```
48+
#!/bin/bash
49+
set -xe
50+
51+
IMAGE_NAME="<YOUR ORGANIZATION>/dsomm:latest"
52+
53+
rm -Rf DevSecOps-MaturityModel || true
54+
git clone git@github.com:wurstbrot/DevSecOps-MaturityModel.git
55+
cp data/* DevSecOps-MaturityModel/data
56+
cp -a selectedData.csv DevSecOps-MaturityModel/selectedData.csv
57+
58+
cd DevSecOps-MaturityModel
59+
docker build -t $IMAGE_NAME .
60+
docker push $IMAGE_NAME
61+
```
62+
This approach also allows teams to perform self assessment with changes tracked in a repository.
63+
64+
## Amazon EC2 Instance
65+
66+
1. In the _EC2_ sidenav select _Instances_ and click _Launch Instance_
67+
2. In _Step 1: Choose an Amazon Machine Image (AMI)_ choose an _Amazon
68+
Linux AMI_ or _Amazon Linux 2 AMI_
69+
3. In _Step 3: Configure Instance Details_ unfold _Advanced Details_ and
70+
copy the script below into _User Data_
71+
4. In _Step 6: Configure Security Group_ add a _Rule_ that opens port 80
72+
for HTTP
73+
5. Launch your instance
74+
6. Browse to your instance's public DNS
75+
76+
```
77+
#!/bin/bash
78+
yum update -y
79+
yum install -y docker
80+
service docker start
81+
docker pull bkimminich/juice-shop
82+
docker run -d -p 80:80 wurstbrot/dsomm:latest
83+
```
84+
3385
# Credits
3486
* The dimension _Test and Verifiacation_ is based on Christian Schneiders [Security DevOps Maturity Model (SDOMM)](https://www.christian-schneider.net/SecurityDevOpsMaturityModel.html). _Application tests_ and _Infrastructure tests_ are added by Timo Pagel. Also, the sub-dimension _Static depth_ has been evaluated by security experts at [OWASP Stammtisch Hamburg](https://www.owasp.org/index.php/OWASP_German_Chapter_Stammtisch_Initiative/Hamburg).
3587
* The sub-dimension <i>Process</i> has been added after a discussion with [Francois Raynaud](https://www.linkedin.com/in/francoisraynaud/) that reactive activities are missing.

‎pushDocker.bash‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
3+
docker build -t wurstbrot/dsomm:latest .
4+
docker push wurstbrot/dsomm:latest

‎startDocker.bash‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
2-
docker build -t dsomm:latest .
2+
docker build -t wurstbrot/dsomm:latest .
33
docker rm -f dsomm || true
4-
docker run --rm -p 81:80 -v "$PWD":/var/www/html --name dsomm dsomm
4+
docker run --rm -p 81:80 -v "$PWD":/var/www/html --name dsomm wurstbrot/dsomm
55

‎yaml2md.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?php
2+
$title = gettext("Activities Overview");
3+
include_once "head.php";
4+
?>
5+
<body>
6+
<?php
7+
include_once "data.php";
8+
include_once "navi.php";
9+
10+
echo "<h1>Matrix</h1>";
11+
echo getTable($dimensions);
12+
13+
echo "<h1>Activtities per Dimension</h1>";
14+
echo '<div class="extra">'.getInfos($dimensions) . '</div>';
15+
?>
16+

0 commit comments

Comments
 (0)