📃Policy-as-Code (PaC) across the stack makes a lot of sense. 👐 it helps you decouple security controls into more purpose-built security capabilities 🧪 It makes security more "testable" as these frameworks come with the ability to unit-test, etc. Here are some PaC Tools and frameworks that can help you with security "across" the stack - @OpenPolicyAgent - The OG of Policy-as-Code. Can be be used anywhere from OSes to API Gateway. Has a Domain specific language called Rego that helps you define and enforce policies with external data to boot - eBPF - Not exactly policy-as-code, but is a great way to codify and enforce security controls by deploying kernel level apps that can enforce security controls for your *Nix machine or container - @kyverno: Super easy policy-management tool for #Kubernetes. The cool thing with kyverno is that you can define the entire policy like a Kubernetes manifest. - @casbinHQ / @osoHQ - RBAC is hard and is the cause of serious vulns like BOLA, BFLA, etc. Dynamic RBAC can be really hairy. AuthZ-as-Code with OPA or one of these tools makes life a lot easier - @HashiCorp Terraform Sentinel is a closed-source product but very useful tool for enforcing Infrastructure-as-Code Policies. This can alternatively be achieved in CI with tools like @semgrep or checkov I am speaking about Policy-as-Code in a demo-filled talk at @SecAppDev 2023. And we're doing some serious deep-dives and labs for Policy-as-Code at our #DevSecOps trainings @BlackHatEvents #BHUSA 2023 - DevSecOps Masterclass (4 Days) => blackhat.com/us-23/training/… - DevSecOps Masterclass: AppSec Automation Edition) - 2 Days => blackhat.com/us-23/training/… and blackhat.com/us-23/training/…