TechPrufer
Sign inGet started

Blogs›GitLab›Threat Modeling Framework

Threat Modeling Framework

Threat Modeling Framework

3
posts
2019–2021

GitLab has developed and adopted a modified PASTA framework for threat modeling, emphasizing its integration into existing development processes. The framework is designed to be easily understood, scalable, and to enhance DevSecOps with minimal overhead. A key aspect is that project teams, rather than solely the security department, run their own threat models using a markdown template, with the security team providing support and review. This approach aims to identify and fix security issues ea

2021

How we’re creating a threat model framework that works for GitLab

7/9/2021

This post introduces GitLab's adoption and adaptation of the PASTA threat modeling framework. It details the challenges of traditional threat modeling (scalability, late involvement, complexity, lack of enjoyment) and how GitLab's modified framework addresses these by being easy to understand, scalable, and integrated into existing development processes. The core contribution is shifting the execution of threat modeling to project teams using a markdown template, with the security team owning the framework and providing review. This aims to improve security posture and development efficiency.

2020

How to secure your Kubernetes pods using GitLab Container Network Security

10/23/2020

This post introduces and details the implementation of Network Policies using Cilium as a GitLab-managed application. It explains how Network Policies act as a firewall for Kubernetes cluster networks, controlling pod communication. The post covers the configuration of ingress and egress traffic using various selectors (podSelector, namespaceSelector, ipBlock) and provides an example YAML for a Network Policy. It also describes the installation process of Cilium as a managed application and highlights the Threat Monitoring dashboard, which visualizes packet flow metrics (inbound/outbound packets, dropped packets) and allows for the creation and editing of Network Policies through an intuitive UI. The post also links to other relevant GitLab security resources.

2019

Securing the journey to continuous delivery

10/30/2019

This post details the Department for Work and Pensions' (DWP) transition to continuous delivery and how they integrated security into their organization's infrastructure and culture. Key aspects include bringing services in-house, adopting an iterative mindset, implementing continuous vulnerability monitoring with GitLab for risky dependencies, and using GitLab as a central point of control. Lessons learned include the importance of automation, identifying pain points, anticipating risks through threat modeling from an external perspective, and understanding that 'continuous' doesn't always mean 'automatic' due to the need for separation of duties.