security-policies.yaml

# DevSecOps Security Policies Configuration
# This file defines security policies and thresholds for the CI/CD pipeline

apiVersion: v1
kind: ConfigMap
metadata:
  name: devsecops-security-policies
  namespace: product-service
data:
  # Security Gate Thresholds
  security-gates.yaml: |
    thresholds:
      vulnerabilities:
        critical: 0      # No critical vulnerabilities allowed
        high: 5          # Maximum 5 high severity vulnerabilities
        medium: 10       # Maximum 10 medium severity vulnerabilities
        low: 50          # Maximum 50 low severity vulnerabilities
      
      sast:
        critical: 0      # No critical SAST issues allowed
        high: 3          # Maximum 3 high severity SAST issues
        medium: 10       # Maximum 10 medium severity SAST issues
      
      secrets:
        allowed: 0       # No secrets allowed in code
      
      license:
        forbidden:       # Forbidden license types
          - "GPL-3.0"
          - "AGPL-3.0"
          - "LGPL-3.0"
        
    # Security scan tools configuration
    tools:
      gitleaks:
        enabled: true
        config: ".gitleaks.toml"
        fail_on_detection: true
      
      semgrep:
        enabled: true
        config: "auto"
        rules:
          - "p/security-audit"
          - "p/owasp-top-ten"
          - "p/cwe-top-25"
      
      trivy:
        enabled: true
        cache_dir: ".trivy"
        timeout: "10m"
        ignore_unfixed: false
        
      checkov:
        enabled: true
        frameworks:
          - "kubernetes"
          - "dockerfile"
          - "terraform"
        
      hadolint:
        enabled: true
        ignore_rules:
          - "DL3008"  # Pin versions in apt get install
          - "DL3009"  # Delete the apt-get lists after installing

  # Compliance requirements
  compliance.yaml: |
    standards:
      - name: "CIS Kubernetes Benchmark"
        version: "1.6.0"
        controls:
          - "1.1.1"  # Ensure that the API server pod specification file permissions are set to 644 or more restrictive
          - "1.1.2"  # Ensure that the API server pod specification file ownership is set to root:root
          - "5.1.1"  # Ensure that the cluster-admin role is only used where required
          - "5.1.3"  # Minimize wildcard use in Roles and ClusterRoles
      
      - name: "NIST Cybersecurity Framework"
        version: "1.1"
        functions:
          - "Identify"
          - "Protect" 
          - "Detect"
          - "Respond"
          - "Recover"
      
      - name: "OWASP Top 10"
        version: "2021"
        categories:
          - "A01:2021 – Broken Access Control"
          - "A02:2021 – Cryptographic Failures"
          - "A03:2021 – Injection"
          - "A06:2021 – Vulnerable and Outdated Components"

  # Security scanning schedule
  scan-schedule.yaml: |
    schedules:
      daily:
        - "dependency-scan"
        - "secret-scan"
      
      weekly:
        - "full-sast-scan"
        - "infrastructure-scan"
      
      monthly:
        - "penetration-test"
        - "compliance-audit"
      
      on_commit:
        - "pre-commit-hooks"
        - "secret-detection"
        - "dockerfile-lint"
      
      on_build:
        - "sast-scan"
        - "dependency-check"
        - "container-scan"
      
      on_deploy:
        - "runtime-security-check"
        - "network-policy-validation"

---
# Security Monitoring ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: security-monitoring-config
  namespace: product-service
data:
  falco-rules.yaml: |
    # Custom Falco rules for runtime security monitoring
    - rule: Detect Shell in Container
      desc: Detect shell execution in container
      condition: >
        spawned_process and container and
        (proc.name in (shell_binaries) or
         proc.name in (bash, sh, zsh, fish))
      output: >
        Shell spawned in container (user=%user.name container=%container.name 
        image=%container.image.repository:%container.image.tag shell=%proc.name)
      priority: WARNING
      tags: [container, shell, mitre_execution]

    - rule: Detect Privilege Escalation
      desc: Detect privilege escalation attempts
      condition: >
        spawned_process and container and
        (proc.name in (sudo, su, doas) or
         proc.args contains "chmod +s")
      output: >
        Privilege escalation attempt (user=%user.name container=%container.name 
        image=%container.image.repository:%container.image.tag command=%proc.cmdline)
      priority: CRITICAL
      tags: [container, privilege_escalation, mitre_privilege_escalation]

  prometheus-rules.yaml: |
    groups:
    - name: security.rules
      rules:
      - alert: HighVulnerabilityCount
        expr: security_vulnerabilities_total{severity="critical"} > 0
        for: 0m
        labels:
          severity: critical
        annotations:
          summary: "Critical vulnerabilities detected"
          description: "{{ $value }} critical vulnerabilities found in {{ $labels.image }}"

      - alert: SecurityScanFailed
        expr: security_scan_success == 0
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Security scan failed"
          description: "Security scan failed for {{ $labels.job }}"

      - alert: UnauthorizedNetworkAccess
        expr: increase(falco_events_total{rule_name="Unexpected network connection"}[5m]) > 0
        for: 0m
        labels:
          severity: warning
        annotations:
          summary: "Unauthorized network access detected"
          description: "Unexpected network connection detected in {{ $labels.container }}"