Cost-Effective Ways for Startups to Improve Application and Cloud Security

Today's broad spectrum of security threats necessitates a variety of specialized tools to address different types of vulnerabilities in applications and cloud infrastructure.

These security solutions often come with high costs, posing a significant burden for startups operating on limited budgets. The expense of acquiring and maintaining a full suite of security tools can be daunting, leaving startups vulnerable if they cannot afford the necessary protection.

One such example is Jit’s Minimal Viable Security (MVS) plan, designed to offer essential security controls at a fraction of the cost, enabling startups to implement strong security measures from the outset.

Now that the basics are out of the way, let's focus on showcasing free and easy-to-use tools that startups can integrate into their workflows.

» Learn more about minimum viable security

In this article, we'll cover some additional cost effective options for application and cloud security tooling, so startups can stay secure without breaking the bank.

1. Scan Custom Code for Vulnerabilities With Semgrep

» Learn how to set up Semgrep rules for optimized scanning

Integrating Semgrep Into the SDLC

Integrating Semgrep into the software development lifecycle (SDLC) is straightforward, particularly within CI/CD pipelines for automated scanning. To set up Semgrep, follow these steps:

1. Install Semgrep: Use the command line to install Semgrep with a simple command:

   pip install semgrep

2. Use pre-configured rulesets: Start by using pre-configured rulesets available from the Semgrep registry, which cover common vulnerabilities and security issues.
3. Customize rules as needed: Customize or create new rules to address specific security concerns unique to your codebase.
4. Automate in CI/CD pipelines: Integrate Semgrep into your CI/CD pipelines by adding a Semgrep scan step to your build process. This ensures that code is automatically scanned for vulnerabilities each time it is pushed or merged. See details below.

Example Configuration for GitLab CI/CD

To integrate Semgrep into your CI/CD pipeline, you can add a job that runs Semgrep as part of your build process. Below is an example configuration for integrating Semgrep into a GitLab CI/CD pipeline:

1. Install Semgrep:

   Add a `before_script` section in your `.gitlab-ci.yml` file to install Semgrep.

2. Configure the .gitlab-ci.yml file: Add a job for running Semgrep during the CI/CD pipeline.

Example .gitlab-ci.yml:

stages:
  - build
  - test

before_script:
  # Install dependencies
  - apt-get update
  - apt-get install -y python3 python3-pip
  # Install Semgrep
  - pip3 install semgrep

build:
  stage: build
  script:
    - echo "Building the project..."

scan:
  stage: test
  script:
    # Run Semgrep scan
    - semgrep --config "p/ci" .
  artifacts:
    paths:
      - semgrep-report.txt

» See our list of our favorite SAST tools

This configuration does the following:

• Defines two stages: build and test
• Installs Semgrep and its dependencies
• Placeholder job for your build process
• Runs Semgrep to scan the codebase for vulnerabilities using a pre-configured ruleset (p/ci) and saves the report as an artifact

2. Scan Open Source Code Vulnerabilities With OSV Scanner

» Here are some other open-source application security tools

Integrating OSV Scanner into the SDLC

Integrating OSV Scanner into the software development lifecycle is straightforward and can significantly enhance the security of your open-source components. Follow these steps to set up OSV Scanner:

1. Install OSV Scanner: You can use Windows Scoop, Homebrew, or other package manager tools to install OSV Scanner, depending on your operating system and programming language. For brew users, simply use the following command:

   brew install osv-scanner 

2. Automate scans in CI/CD pipelines: Add OSV Scanner to your CI/CD pipelines to automatically scan dependencies during the build process. To add OSV Scanner to your CI/CD pipelines, configure your CI/CD tool to run OSV Scanner during the build process. For GitHub Actions, create a `.github/workflows/osv-scanner.yml` file with steps to set up the Go environment, install the OSV Scanner, and run it on the repository. For GitLab CI/CD, create a `.gitlab-ci.yml` file with a similar setup using the Go image. Both configurations ensure that OSV Scanner scans dependencies during the build process, detecting vulnerabilities before deployment.
3. Regular monitoring: Schedule regular scans of your open-source dependencies to stay updated with the latest vulnerabilities and apply patches as needed.

» Compare OSV Scanner to npm-audit

Example Configuration for GitLab CI/CD

You can integrate OSV Scanner into your GitLab CI/CD pipeline by following these steps:

1. Install OSV Scanner: Use a `before_script` section in your `.gitlab-ci.yml` file to install OSV Scanner.

2. Configure the .gitlab-ci.yml file: Add a job for running OSV Scanner during the CI/CD pipeline.

Example .gitlab-ci.yml:

stages:
  - build
  - test

before_script:
  - apt-get update
  - apt-get install -y curl
  - curl -sSfL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh | bash
  - echo 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"' >>~/.profile
  - eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
  - brew install osv-scanner

build:
  stage: build
  script:
    - echo "Building the project..."

scan:
  stage: test
  script:
    - osv-scanner --recursive .
  artifacts:
    paths:
      - osv-scanner-report.json 

3. Scan Your Repositories for Hardcoded Secrets With gitleaks

» Here are some tips for running secret scans with gitleaks and Jit

Integrating Gitleaks into the SDLC

Integrating Gitleaks into the SDLC is a simple process that can significantly enhance the security of your repositories. Here are the steps to set it up:

1. Install Gitleaks: Use the command line to install Gitleaks with a simple command:

   go get github.com/zricethezav/gitleaks/v7 

2. Use pre-configured detection patterns: Start by using pre-configured detection patterns available from Gitleaks, which cover common secrets and sensitive information.
3. Customize detection patterns: Customize or create new detection patterns to address specific security concerns unique to your codebase.
4. Automate in CI/CD pipelines: Integrate Gitleaks into your CI/CD pipelines by adding a Gitleaks scan step to your build process. This ensures that repositories are automatically scanned for hardcoded secrets each time code is pushed or merged.

» See the developer guide to implementing gitleaks

4. Scan Your Infrastructure as Code for Cloud Vulnerabilities With KICS

» Review the best cloud security tools

Integrating KICS into the SDLC

Integrating KICS into the software development lifecycle (SDLC) is straightforward, especially within secure CI/CD pipelines for automated scanning. Here are the steps to integrate KICS:

1. Install KICS: You can install KICS using Docker or directly from the source. For Docker, use the command:

   docker pull checkmarx/kics 

2. Set up scanning: Configure KICS to scan your IaC files. You can create a configuration file to specify the types of scans and rules you want to apply.
3. Automate scans in CI/CD pipelines: Add KICS to your CI/CD pipelines to automatically scan IaC files during the build process. This ensures that any vulnerabilities are detected and addressed early in the development process.

» See these other great IaC security tools

Example KICS Configuration With GitHub Actions

name: KICS Scan

on: [push, pull_request]

jobs:
  kics-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Install Docker
        run: sudo apt-get install docker.io

      - name: Run KICS
        run: docker run -v $(pwd):/kics-project checkmarx/kics:latest -p /kics-project

Regular scans of IaC files help maintain secure configurations as your infrastructure evolves.

» See our list of IaC security essentials

5. Implement CI/CD Misconfiguration Checks with Legitify

Integrating Legitify into the SDLC

Integrating Legitify into the SDLC involves setting it up to automatically audit CI/CD configurations during the build and deployment process. Here are the steps to integrate Legitify:

1. Install Legitify: You can install Legitify using the command:

   go get github.com/circa10a/legitify

2. Configure Legitify: Set up Legitify to audit your CI/CD configurations by creating a configuration file that specifies the rules and checks you want to apply.
3. Automate audits in CI/CD pipelines: Add Legitify to your CI/CD pipelines to automatically audit configurations during the build and deployment stages.

» Take a deeper dive into Legitify to detect CI/CD misconfigurations

Example GitHub Actions Configuration

name: Legitify Scan

on: [push, pull_request]

jobs:
  legitify-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Install Legitify
        run: go get github.com/circa10a/legitify

      - name: Run Legitify
        run: legitify scan --config .legitify.yaml 

Regular reviews and audits of CI/CD systems help maintain secure configurations over time.

» Need more help? Here's how to use Legitify to detect misconfigurations

Simplifying Security for Startups With Jit

Jit is a DevSecOps platform specifically designed to streamline the implementation of multiple security tools for startups. It provides an integrated approach to security management, consolidating various tools into a single, cohesive platform. By doing so, Jit simplifies the complex task of managing security across different stages of the SDLC.

Jit integrates powerful tools such as Semgrep, OSV Scanner, Gitleaks, KICS, and Legitify, offering comprehensive security coverage from code vulnerabilities to infrastructure misconfigurations. This unified platform helps startups maintain robust security practices without the need for extensive resources or expertise.

» See Jit's platform overview

Benefits of Using Jit

• Integrated and unified security solutions: Jit consolidates various tools into a unified platform, reducing complexity and making it easier to manage security across different stages of the SDLC.
• Developer-friendly: Developers never need to leave their environment to surface and resolve code vulnerabilities. With fast scanning times and auto remediation, developers to independently resolve issues before production.
• Cost-effective: Moreover, Jit offers a pricing structure that is highly affordable for startups. It is free for a team consisting of up to three developers, making it accessible to small teams. For larger teams, the cost is $50 per developer per month, providing a scalable and affordable security solution.

» Discover the key techniques every DevSecOps pro needs

By leveraging Jit, startups can enhance their security posture effectively and efficiently, ensuring that they are protected against a wide range of security threats while maintaining focus on their core development activities.