Bonnes pratiques DevSecOps

---

1 - OWASP Top 10

1.1 Les 10 risques (2021)

Rank	Risque	Prévention
A01	Broken Access Control	RBAC, AuthZ checks
A02	Cryptographic Failures	TLS, Encryption
A03	Injection	Input validation, parameterized queries
A04	Insecure Design	Threat modeling
A05	Security Misconfiguration	Hardening, scanning
A06	Vulnerable Components	SCA, updates
A07	Identification Failures	MFA, secure auth
A08	Software Integrity Failures	Supply chain security
A09	Logging Failures	Audit logging
A10	SSRF	Input validation, allowlists

1.2 Checklist OWASP

owasp_checklist:
  authentication:
    - [ ] MFA enabled
    - [ ] Strong password policy
    - [ ] Secure session management
    - [ ] Account lockout
    
  authorization:
    - [ ] RBAC implemented
    - [ ] Authorization checked server-side
    - [ ] Least privilege principle
    
  data_protection:
    - [ ] Data encrypted at rest
    - [ ] Data encrypted in transit
    - [ ] PII properly handled
    - [ ] Secure key management
    
  input_output:
    - [ ] Input validation
    - [ ] Output encoding
    - [ ] Parameterized queries
    - [ ] Content Security Policy
    
  logging:
    - [ ] Security events logged
    - [ ] No sensitive data in logs
    - [ ] Log integrity protected

---

2 - Security Champions Program

2.1 Structure

2.2 Responsabilités

Responsabilité	Description
Training	Former l'équipe aux pratiques secure
Review	Review sécurité du code
Triage	Évaluer les vulnérabilités
Advocate	Promouvoir la sécurité
Escalation	Remonter les problèmes
Tooling	Configurer les outils

2.3 Formation

training_curriculum:
  level_1_awareness:
    duration: 4 hours
    topics:
      - OWASP Top 10
      - Secure coding basics
      - Common vulnerabilities
    
  level_2_developer:
    duration: 2 days
    topics:
      - Advanced secure coding
      - SAST/DAST tools
      - Threat modeling
    
  level_3_champion:
    duration: 1 week
    topics:
      - Security architecture
      - Penetration testing basics
      - Incident response
      - Security tooling deep dive

---

3 - Métriques de sécurité

3.1 KPIs essentiels

Métrique	Description	Cible
MTTD	Mean Time To Detect	< 24h
MTTR	Mean Time To Remediate	< 7 jours (high)
Vulnerability Escape Rate	Vulns en prod / Total	< 5%
Security Debt	Vulns backlog	Décroissant
Coverage	% code scanné	> 90%
False Positive Rate	Faux positifs / Total	< 10%
Security Training	% devs formés	> 90%

3.2 Dashboard

dashboard_sections:
  overview:
    - total_vulnerabilities: 185
    - critical: 0
    - high: 12
    - medium: 45
    - low: 128
    
  trends:
    - new_this_week: 8
    - fixed_this_week: 15
    - average_fix_time: 5.2 days
    
  sla_compliance:
    - critical_24h: 100%
    - high_7d: 95%
    - medium_30d: 88%
    
  coverage:
    - sast_coverage: 95%
    - dast_coverage: 80%
    - container_scan: 100%

---

4 - Secure SDLC

4.1 Security Gates

4.2 Gate Criteria

security_gates:
  development:
    sast:
      critical: 0
      high: 0
      block_on_fail: true
    secrets:
      any_found: block
      
  build:
    sca:
      critical: 0
      high: 5
    container:
      critical: 0
      high: 10
      
  deploy:
    dast:
      critical: 0
      high: 0
    compliance:
      cis_pass: required
      custom_policies: required

---

5 - Automation

5.1 Pipeline sécurisé

# Complete DevSecOps Pipeline
stages:
  - pre-commit
  - build
  - test
  - security
  - deploy

pre-commit:
  stage: pre-commit
  script:
    - gitleaks detect --source .
    - semgrep --config auto --error

build:
  stage: build
  script:
    - npm ci --ignore-scripts
    - npm run build
    - docker build -t $IMAGE .

security-scan:
  stage: security
  parallel:
    matrix:
      - SCAN: [sast, sca, container, iac]
  script:
    - case $SCAN in
        sast) sonar-scanner ;;
        sca) snyk test --severity-threshold=high ;;
        container) trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE ;;
        iac) checkov -d ./terraform/ ;;
      esac
  allow_failure: false

dast:
  stage: security
  script:
    - docker-compose up -d
    - zap-baseline.py -t http://app:8080
  needs: [build]

deploy:
  stage: deploy
  script:
    - kubectl apply -f k8s/
  needs: [security-scan, dast]
  only:
    - main

5.2 Auto-remediation

# Dependabot auto-merge pour patches
name: Auto-merge Dependabot

on: pull_request

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Auto-approve
        uses: hmarr/auto-approve-action@v3
        if: contains(github.event.pull_request.title, 'patch')
        
      - name: Auto-merge
        uses: pascalgn/automerge-[email protected]
        if: contains(github.event.pull_request.title, 'patch')
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MERGE_METHOD: squash

---

6 - Culture de sécurité

6.1 Principes

security_culture:
  principles:
    - Security is everyone's responsibility
    - Fail fast, fix fast
    - No blame, continuous improvement
    - Transparency about vulnerabilities
    
  practices:
    - Weekly security office hours
    - Bug bounty program
    - Security retrospectives
    - Recognition for security fixes

6.2 Gamification

Badge	Critère
🛡️ Security Champion	Certification complète
🔍 Bug Hunter	10 vulns trouvées
⚡ Quick Fixer	Fix < 24h
📚 Knowledge Sharer	5 formations données

---

7 - Checklist Production

## Pre-Production Security Checklist

### Code Security
- [ ] SAST scan passed (0 critical/high)
- [ ] No hardcoded secrets
- [ ] Input validation implemented
- [ ] Output encoding implemented

### Dependencies
- [ ] SCA scan passed
- [ ] No known critical vulnerabilities
- [ ] Dependencies up to date
- [ ] SBOM generated

### Infrastructure
- [ ] IaC scan passed
- [ ] Least privilege configured
- [ ] Network segmentation
- [ ] Encryption enabled

### Authentication
- [ ] MFA enabled
- [ ] Strong password policy
- [ ] Session management secure

### Monitoring
- [ ] Security logging enabled
- [ ] Alerts configured
- [ ] SIEM integrated

### Documentation
- [ ] Security architecture documented
- [ ] Runbooks available
- [ ] Incident response plan ready

---

Résumé

Dans ce chapitre, nous avons couvert :

• L'OWASP Top 10 et les préventions
• Le programme Security Champions
• Les métriques de sécurité
• Le Secure SDLC et les gates
• L'automation des checks
• La culture de sécurité

---

Prochaine étape

Dans le prochain chapitre, nous mettrons en pratique avec des Exercices et Projets.

→ Chapitre suivant : Exercices et Projets

---

← Retour à la table des matières