Bahmni Security Agents

Context We have lot of guidance documented for right security practices while installing Bahmni e.g. setting up right permission, root access etc. but currently there is no way to keep the respective implementation support / maintenance team informed about possible vulnerabilities.

Bahmni security agents would run on Linux machines (on-prem or cloud) where bahmni is installed and would scan for possible vulnerabilities with respect to

• Policies (inappropriate permissions, root access etc)
• Open ports
• Libraries / Dependencies used by the application that have know vulnerabilities
• OS Security updates missing

See here, Security Scanning with Trivy

• Opensource tool backed by Aquasec
• Lightweight — comprehensive vulnerability assessment which supports container, filesystem and remote git-repo scanning.
• Supports filesystem scanning, image scanning, Github repository scanning and secret scanning
• Has integration options with K8s
• Detects vulnerabilities and has a rich database for vulnerabilities with possible fixes as well as recommendations
• Integrates well in Github Action / any CI as well
• Supports different forms of reports
• Maintained very well
• Ref:https://aquasecurity.github.io/trivy/v0.29.2/
• https://github.com/aquasecurity/trivy관련 문서: https://aquasecurity.github.io/trivy/v0.29.2/
• Adopt in Thoughtworks Tech Radar: https://www.thoughtworks.com/radar/tools/trivy관련 문서: https://github.com/aquasecurity/trivy

See here, Security Compliance Testing of Bahmni Servers using OpenSCAP

• Open Source tool backed by RedHat.
• Compliance as Code approach.
• Built on top of SCAP standard and tests.
• More focussed on performing configuration compliance and vulnerability scanning on local system.
• Ref:OpenSCAP

In order to prevent leakage of secrets it is highly recommended to install Talisman as a global pre-commit hook in the developer’s machine.

• Tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer's workstation.
• validates the outgoing changeset for things that look suspicious - such as: potential SSH keys
• authorization tokens
• private keys etc.

Ref:

• https://github.com/thoughtworks/talisman

• Can be installed on CI/CD.
• Scans through commit history
• Modifiable with flags and additional regex
• Catches other types of hashes that might be a risk (URLs)
• Does not have an option to ignore some non-sensitive secrets
• Ref:https://github.com/trufflesecurity/trufflehog

See here, Secrets Scanning with Trivy관련 문서: Security Scanning with Trivy

• Black Box Testing
• Scans applications and networks for specific compliance requirements.
• Analyses network devices, servers and operating systems for vulnerabilities.
• Perfroms hands-on live simulations and penetration tests.
• Resource Intensive
• Ref:https://www.openvas.org/
• https://offsec.vchur.dk/2019/02/25/vulnerability-scanning-openvas/#OpenVAS_Alerts관련 문서: https://www.openvas.org/
• https://securitytrails.com/blog/openvas-vulnerability-scanner관련 문서: https://offsec.vchur.dk/2019/02/25/vulnerability-scanning-openvas/#OpenVAS_Alerts

• Vuls is open-source, agent-less vulnerability scanner: https://vuls.io/
• non-os package dependency check available
• alerts on slack and e-mails available
• prometheus vuls exporter on official grafana website available for dashboard
• default port scanner available and we can configure nmap as well
• Ref:https://vuls.io/
• https://grafana.com/grafana/dashboards/12255관련 문서: https://vuls.io/

• https://docs.google.com/spreadsheets/d/1dJqY_g3rB6R-jl-RBE28V5d_-DrMv3USHuQDT5qxCoQ/edit#gid=0
• https://medium.com/@omayrfayaz/security-agents-for-open-source-projects-d5f5405d5048