Sqreen's Application Security Management for the Go language

Last update: Dec 27, 2022

Comments: 14

Sqreen's Application Security Management for Go

After performance monitoring (APM), error and log monitoring it’s time to add a security component into your app. Sqreen’s microagent automatically monitors sensitive app’s routines, blocks attacks and reports actionable infos to your dashboard.

Sqreen provides automatic defense against attacks:

Protect with security modules: RASP (Runtime Application Self-Protection), in-app WAF (Web Application Firewall), Account takeovers and more.
Sqreen’s modules adapt to your application stack with no need of configuration.
Prevent attacks from the OWASP Top 10 (Injections, XSS and more), 0-days, data Leaks, and more.
Create security automation playbooks that automatically react against your advanced business-logic threats.

For more details, visit sqreen.com

Quick start

Use the middleware function for the Go web framework you use:
- net/http
- Gin
- Echo
If your framework is not listed, it is usually possible to use instead the standard net/http middleware. If not, please, let us know by creating an issue.
Compile your program with Sqreen

Sqreen's dynamic configuration of your protection is made possible thanks to Go instrumentation. It is safely performed at compilation time by the following instrumentation tool.

Install the following instrumentation tool and compile your program using it in order to enable Sqreen.
1. Use go install to compile the instrumentation tool:
```
$ go install github.com/sqreen/go-agent/sdk/sqreen-instrumentation-tool
```
  By default, the resulting sqreen-instrumentation-tool tool is installed in the bin directory of the GOPATH. You can find it using go env GOPATH.
2. Configure the Go toolchain to use it:
  
  Use the instrumentation tool using the go options -a -toolexec /path/to/sqreen-instrumentation-tool.
  
  It can be done either in your Go compilation command lines or by setting the GOFLAGS environment variable.
  
  For example, the following two commands are equivalent:
```
$ go build -a -toolexec $(go env GOPATH)/bin/sqreen-instrumentation-tool my-project
$ env GOFLAGS="-a -toolexec $(go env GOPATH)/bin/sqreen-instrumentation-tool" go build my-project
```
Signup to Sqreen to get your app credentials:
```
app_name: Your Go app name
token: your token
```
This file can be stored in your current working directory when starting the executable, the same directory as your app's executable file, or in any other path by defining the configuration file location into the environment variable SQREEN_CONFIG_FILE.

Congratulations, your Go web application is now protected by Sqreen!

Advanced integration

Optionally, use the SDK to perform user monitoring or custom security events you would like to track and possibly block.

Owner

Sqreen

Sqreen is a security platform protecting web applications

https://github.com/sqreen/go-agent https://sqreen.com

Comments

agent: making agent internals private

Move the agent internals into a package named internal, which makes it importable from parent packages only, and thus impossible to import from outside packages.

It is therefore required to separate the SDK dependency to the agent internals by defining a Go interface including everything it expects from the agent. The agent automatically "sets itself" on initialization. When the agent is not included, the SDK uses a disabled agent, which no-ops everything.

A consequence is that it is easy now to unit-test the SDK with 100% coverage by simply mocking the agent and checking everything.

Related to SQR-5192, SQR-5204, SQR-5242 and SQR-5262.
sdk/middleware/sqgin: fix request ctx

This fixes a bug where gin's c.Request's context gets overwritten by the sqgin middleware

If you set some values in the context of c.Request, you won't be able to retrieve them after sqgin's 'middlewareHandler' has done its work
Optimize the WAF with large requests
Enforce a few memory limits so that the new benchmark is fast enough (ie. ~1ms max) no matter the input request.

To do so:

the binding accessor execution limits its maximum traversal depth.

the binding accessor transformation limits its number of results and traversal depth.

WAF value marshaling has been optimized in https://github.com/sqreen/go-libsqreen/pull/8 using the new benchmark.

A lot of new tests have been added to cover hopefully every possible case.
Configurable blocking security response
Make the existing blocking security response HTTP handler configurable by Sqreen rules received at run time. This feature introduces the first building blocks of "dynamic instrumentation" for Go, in particular a hooking library in pure Go.

[x] API to get the list of rules

[x] Implement the rules reloading agent command.

[x] Adapt the agent logic of instrumentation enable/disable with rules reloading.

[x] Implement the rule engine required for this feature and this rule.

[x] Implement a hooking library for Go that will be used in the security response's HTTP handler.

[x] Add a hook into the security response HTTP handler.

[x] Implement the callback factory used by the rule engine to instantiate callbacks to be attached to a hook.

[x] Add a development configuration option to add local rules.
Release v0.1.0-beta.5

| # | x | Content | Record | | :----: | :-: | ----- | ----- | | 0 | x | Ensure that the release schedule is followed | | | 1 | x | Check the pull requests on the agent. Any left open should have a good reason to be | | | 2 | x | Make sure every projected ticket for this release in Jira has been resolved. Move them otherwise. | | | 3 | x | Check pull requests on ShieldRules and other actions on Rules | N/A | | 4 | N/A | Launch integrations tests on the release PR | N/A | | 5 | x | Perform manual tests against current production backend | | | 6 | x | Perform performance tests | perf-tests | | 7 | x | Update CHANGELOG.md | | | 8 | x | Update the documentation, including the release note | https://github.com/sqreen/Documentation/pull/438 | | 9 | x | Update Agent feature matrix | agent-matrix | | 10 | N/A | Deploy rules to enable a new agent feature. Ensure the rule includes the agent's version. | | | 11 | x | Organize a dogfooding session. Target the common architectures of our clients. | |
Release v0.1.0 beta.3

| # | x | Content | Record | | :----: | :-: | ----- | ----- | | 0 | x | Ensure that you are respecting the release schedule (only release every other week in normal circumstances) | | | 1 | x | Check the pull requests on the agent. Any left open should have a good reason to be | | | 2 | N/A | If the release already exist in Jira, make sure every projected ticket for this release has been resolved. Create it otherwise. | | | 3 | N/A | Check pull requests on ShieldRules and other actions on Rules. | | | 4 | x | Launch integrations tests on the PR. Meanwhile, perform manual tests against current production backend. | | | 5 | x | Perform performance tests | | | 6 | x | Update Changelog in the agent GIT repo | | | 7 | x | Add potential changes of agent behavior to the agents documentation | | | 8 | x | Update Agent feature matrix | | | 9 | N/A | Merge PR (expect for Go) | | | 10 | N/A | If a rule need to be deployed to enable a new agent feature, it should be deployed then. Ensure rule is versioned accordingly to this agent's version. | | | 11 | x | Organize a dogfooding session with your buddy (1h+). Target the common architectures of our clients. | | | 12 | N/A | Trigger one click deploy on Jenkins or merge to master for Go. | | | 13 | N/A | For PHP only, create new version for extension (and / or daemon) in Admin interface | | | 14 | X | Create PR with release notes in documentation repository | | | 15 | N/A | Update agents of Sqreen services to use latest agent versions (e.g. Python: Back-End, Java: Jenkins, ...). | | | 16 | X | Send an email to the team regarding the release. | |
sdk/middleware/sqiris: middleware function for Iris
[x] Middleware function for Iris.

[x] Iris-specific FromContext() function as Iris' context does not implement the Go context interface

[ ] Wait for kataras/iris#1180 to be able to modify the request and be able to use sdk.FromContext().

Closes SQR-5407

Jenkinsfile Update

I checked the Jenkinsfile and i was wondering, why you do not just use containers with the dependencies you need in different steps ?

You could have a container with make, one with go, one with codecov and run it instead of building your own image no ?

You can keep yours for local dev still :)

You don't have to use only one container for your build :)

You would write it like so : ! This is not valid syntax, it's just to explain the idea

podTemplate(containers: [go, make, codecov]) { stage('Tests') { parallel([ 'Regular': { container('go') { sh 'go env'

                       }
                       container('make') { 
                             sh 'make test'
                        }
                    },
                    'With coverage': {
                         container('make') { 
                            sh 'make test-coverage'
                        }
                        container('codevov') { 
                            codecov.analyze('codecov-agent-go-token')
                        }
                    },
                    'With race detection': {
                        container('make') { 
                             sh 'make test-race'
                        }
                    }
                ])

}

Version in `./internal/version/version.go` shows 1.0.4 (for the 1.0.5 tag / master)

The version located in internal/version/version.go is 1.0.4 - but the repo is tagged at 1.0.5

This makes it a bit confusing when you build the instrumentation agent and it says 1.0.4 even though you're pulling down the 1.0.5 tagged code.
agent/protection/http: lazy access to post form values

Remove the current call to ParseForm() in the middlewares in favor of a direct access to the cached value in the Request structure. This value is not nil when the request handler has called ParseForm() itself. Meaning that the In-WAF and RASP protections will now only consider the POST form values of the request when actually parsed by the request handler.

Note that the In-App WAF is now dynamically attached to ParseForm() which returns a non-nil error of type *SqreenError when blocked by the In-App WAF (cf. https://docs.sqreen.com/go/integration for more details).

This fixes the usage of the Go agent in a reverse proxy server where the agent was consuming the body because of the call to ParseForm(), making later reads to Request.Body return EOF. A server can now correctly copy the request body.
In-App WAF
The Web-Application Firewall allows to block HTTP requests as early as possible. The WAF rules are configured into the dashboard and can either monitor or block the request when they matched.

Implementation:

[x] Add a binding accessor expression compiler to dynamically get data from a given data context

[x] Adapt the rule engine to call a Close() method when a callback is removed in order to release C++ library memory which is out of the GC's scope.

[x] Adapt the rule context passed to callbacks in order to create WAF attack events.

[x] Refactor the request record into its own package in order to be able to use it from callbacks to add WAF attack events.

[x] Add a new in-app WAF callback using the bindings to the C++ WAF library:

[x] Compile binding accessor expressions provided by the in-app WAF rule.

[x] Convert the resulting Go value to the expected C++ WAF library input values.

[x] Add a new hookpoint suitable for the in-app WAF callback early in the request handling.
build(deps): bump github.com/labstack/echo/v4 from 4.1.17 to 4.9.0
Bumps github.com/labstack/echo/v4 from 4.1.17 to 4.9.0.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.9.0

Security

Fix open redirect vulnerability in handlers serving static directories (e.Static, e.StaticFs, echo.StaticDirectoryHandler) #2260

Enhancements

Allow configuring ErrorHandler in CSRF middleware #2257

Replace HTTP method constants in tests with stdlib constants #2247

v4.8.0

Most notable things

You can now add any arbitrary HTTP method type as a route #2237

e.Add("COPY", "/*", func(c echo.Context) error return c.String(http.StatusOK, "OK COPY") })

You can add custom 404 handler for specific paths #2217

e.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })
g := e.Group("/images") g.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })

Enhancements

Add new value binding methods (UnixTimeMilli,TextUnmarshaler,JSONUnmarshaler) to Valuebinder #2127

Refactor: body_limit middleware unit test #2145

Refactor: Timeout mw: rework how test waits for timeout. #2187

BasicAuth middleware returns 500 InternalServerError on invalid base64 strings but should return 400 #2191

Refactor: duplicated findStaticChild process at findChildWithLabel #2176

Allow different param names in different methods with same path scheme #2209

Add support for registering handlers for different 404 routes #2217

Middlewares should use errors.As() instead of type assertion on HTTPError #2227

Allow arbitrary HTTP method types to be added as routes #2237

v4.7.2

Fixes

Fix nil pointer exception when calling Start again after address binding error #2131

Fix CSRF middleware not being able to extract token from multipart/form-data form #2136

Fix Timeout middleware write race #2126

Enhancements

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.9.0 - 2022-09-04

Security

Fix open redirect vulnerability in handlers serving static directories (e.Static, e.StaticFs, echo.StaticDirectoryHandler) #2260

Enhancements

Allow configuring ErrorHandler in CSRF middleware #2257

Replace HTTP method constants in tests with stdlib constants #2247

v4.8.0 - 2022-08-10

Most notable things

You can now add any arbitrary HTTP method type as a route #2237

e.Add("COPY", "/*", func(c echo.Context) error return c.String(http.StatusOK, "OK COPY") })

You can add custom 404 handler for specific paths #2217

e.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })
g := e.Group("/images") g.RouteNotFound("/*", func(c echo.Context) error { return c.NoContent(http.StatusNotFound) })

Enhancements

Add new value binding methods (UnixTimeMilli,TextUnmarshaler,JSONUnmarshaler) to Valuebinder #2127

Refactor: body_limit middleware unit test #2145

Refactor: Timeout mw: rework how test waits for timeout. #2187

BasicAuth middleware returns 500 InternalServerError on invalid base64 strings but should return 400 #2191

Refactor: duplicated findStaticChild process at findChildWithLabel #2176

Allow different param names in different methods with same path scheme #2209

Add support for registering handlers for different 404 routes #2217

Middlewares should use errors.As() instead of type assertion on HTTPError #2227

Allow arbitrary HTTP method types to be added as routes #2237

v4.7.2 - 2022-03-16

Fixes

Fix nil pointer exception when calling Start again after address binding error #2131

Fix CSRF middleware not being able to extract token from multipart/form-data form #2136

Fix Timeout middleware write race #2126

... (truncated)

Commits

16d3b65 Changelog for 4.9.0

0ac4d74 Fix #2259 open redirect vulnerability in echo.StaticDirectoryHandler (used by...

d77e8c0 Added ErrorHandler and ErrorHandlerWithContext in CSRF middleware (#2257)

534bbb8 replace POST constance with stdlib constance

fb57d96 replace GET constance with stdlib constance

d48197d Changelog for 4.8.0

cba12a5 Allow arbitrary HTTP method types to be added as routes

a327884 add:README.md-Third-party middlewares-github.com/go-woo/protoc-gen-echo

61422dd Update CI-flow (Go 1.19 +deps)

a9879ff Middlewares should use errors.As() instead of type assertion on HTTPError

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
build(deps): bump github.com/gin-gonic/gin from 1.3.0 to 1.7.0
Bumps github.com/gin-gonic/gin from 1.3.0 to 1.7.0.

Release notes

Sourced from github.com/gin-gonic/gin's releases.

Release v1.7.0

BUGFIXES

fix compile error from #2572 (#2600)

fix: print headers without Authorization header on broken pipe (#2528)

fix(tree): reassign fullpath when register new node (#2366)

ENHANCEMENTS

Support params and exact routes without creating conflicts (#2663)

chore: improve render string performance (#2365)

Sync route tree to httprouter latest code (#2368)

chore: rename getQueryCache/getFormCache to initQueryCache/initFormCa (#2375)

chore(performance): improve countParams (#2378)

Remove some functions that have the same effect as the bytes package (#2387)

update:SetMode function (#2321)

remove a unused type SecureJSONPrefix (#2391)

Add a redirect sample for POST method (#2389)

Add CustomRecovery builtin middleware (#2322)

binding: avoid 2038 problem on 32-bit architectures (#2450)

Prevent panic in Context.GetQuery() when there is no Request (#2412)

Add GetUint and GetUint64 method on gin.context (#2487)

update content-disposition header to MIME-style (#2512)

reduce allocs and improve the render WriteString (#2508)

implement ".Unwrap() error" on Error type (#2525) (#2526)

Allow bind with a map[string]string (#2484)

chore: update tree (#2371)

Support binding for slice/array obj [Rewrite] (#2302)

basic auth: fix timing oracle (#2609)

Add mixed param and non-param paths (port of httprouter#329) (#2663)

feat(engine): add trustedproxies and remoteIP (#2632)

Improve performance

ENHANCEMENTS

Improve performance: Change *sync.RWMutex to sync.RWMutex in context. #2351

release v1.6.2

Release Notes

BUGFIXES

fix missing initial sync.RWMutex (#2305)

ENHANCEMENTS

Add set samesite in cookie. (#2306)

Contributors

@appleboy

release v1.6.1

... (truncated)

Changelog

Sourced from github.com/gin-gonic/gin's changelog.

Gin v1.7.0

BUGFIXES

fix compile error from #2572 (#2600)

fix: print headers without Authorization header on broken pipe (#2528)

fix(tree): reassign fullpath when register new node (#2366)

ENHANCEMENTS

Support params and exact routes without creating conflicts (#2663)

chore: improve render string performance (#2365)

Sync route tree to httprouter latest code (#2368)

chore: rename getQueryCache/getFormCache to initQueryCache/initFormCa (#2375)

chore(performance): improve countParams (#2378)

Remove some functions that have the same effect as the bytes package (#2387)

update:SetMode function (#2321)

remove a unused type SecureJSONPrefix (#2391)

Add a redirect sample for POST method (#2389)

Add CustomRecovery builtin middleware (#2322)

binding: avoid 2038 problem on 32-bit architectures (#2450)

Prevent panic in Context.GetQuery() when there is no Request (#2412)

Add GetUint and GetUint64 method on gin.context (#2487)

update content-disposition header to MIME-style (#2512)

reduce allocs and improve the render WriteString (#2508)

implement ".Unwrap() error" on Error type (#2525) (#2526)

Allow bind with a map[string]string (#2484)

chore: update tree (#2371)

Support binding for slice/array obj [Rewrite] (#2302)

basic auth: fix timing oracle (#2609)

Add mixed param and non-param paths (port of httprouter#329) (#2663)

feat(engine): add trustedproxies and remoteIP (#2632)

Gin v1.6.3

ENHANCEMENTS

Improve performance: Change *sync.RWMutex to sync.RWMutex in context. #2351

Gin v1.6.2

BUGFIXES

fix missing initial sync.RWMutex #2305

ENHANCEMENTS

Add set samesite in cookie. #2306

Gin v1.6.1

BUGFIXES

Revert "fix accept incoming network connections" #2294

... (truncated)

Commits

d496f64 bump to v1.7.0 version (#2672)

bfc8ca2 feat(engine): add trustedproxies and remoteIP (#2632)

f3de813 Add mixed param and non-param paths (port of httprouter#329) (#2663)

a331dc6 chore: remove duplicate test 'assert.Equal' (#2617)

ed6f85c build: convert to go:build directives (#2664)

1bdf86b Remove the tedious named return value (#2620)

e899771 chore: Deleted spaces (#2622)

b01605b basic auth: fix timing oracle (#2609)

46ddd42 Fixes to the graceful shutdown example (#2552)

f4bc259 fix error gin support min Go version (#2584)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Custom Error Response

Hi -

I was looking through the library and there's currently no way to write a different error other than the html and response code that Sqreen sends.

I would like to show a custom error message on our React app when Sqreen shows an aborted request. I did notice that there were hooks in the internal package to enable those error messages, but maybe I missed it in my quick scan to be able to hook into those hooks?

I would set a custom status code in the Sqreen dashboard but that's not possible (only allows 400-599 status codes).

Thanks!

Web-Security-Academy - Web Security Academy, developed in GO

Feb 23, 2022

A tool for secrets management, encryption as a service, and privileged access management

Vault Please note: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please respo

Jan 2, 2023

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

Database protection suite with field level encryption and intrusion detection. | Acra Engineering Examples | Documentation | Installation | Examples a

Dec 28, 2022

Sqreen's Application Security Management for the Go language

Sqreen's Application Security Management for Go

Quick start

Advanced integration

Owner

Sqreen

Comments

agent: making agent internals private

sdk/middleware/sqgin: fix request ctx

Optimize the WAF with large requests

Configurable blocking security response

Release v0.1.0-beta.5

Release v0.1.0 beta.3

sdk/middleware/sqiris: middleware function for Iris

Jenkinsfile Update

Version in `./internal/version/version.go` shows 1.0.4 (for the 1.0.5 tag / master)

agent/protection/http: lazy access to post form values

In-App WAF

build(deps): bump github.com/labstack/echo/v4 from 4.1.17 to 4.9.0

v4.9.0

v4.8.0

v4.7.2

v4.9.0 - 2022-09-04

v4.8.0 - 2022-08-10

v4.7.2 - 2022-03-16

build(deps): bump github.com/gin-gonic/gin from 1.3.0 to 1.7.0

Release v1.7.0

BUGFIXES

ENHANCEMENTS

Improve performance

ENHANCEMENTS

release v1.6.2

Release Notes

Contributors

release v1.6.1

Gin v1.7.0

BUGFIXES

ENHANCEMENTS

Gin v1.6.3

ENHANCEMENTS

Gin v1.6.2

BUGFIXES

ENHANCEMENTS

Gin v1.6.1

BUGFIXES

Custom Error Response

Related tags

Web-Security-Academy - Web Security Academy, developed in GO

A tool for secrets management, encryption as a service, and privileged access management

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

HTTP middleware for Go that facilitates some quick security wins.

Gryffin is a large scale web security scanning platform.

set of web security test cases and a toolkit to construct new ones

PHP security vulnerabilities checker

Tracee: Linux Runtime Security and Forensics using eBPF

A scalable overlay networking tool with a focus on performance, simplicity and security

How to systematically secure anything: a repository about security engineering

Convenience of containers, security of virtual machines

MQTT安全测试工具 (MQTT Security Tools)

gosec - Golang Security Checker

GoPhish by default tips your hand to defenders and security solutions. T

Go binary that finds .EXEs and .DLLs on the system that don't have security controls enabled

One Time Passwords (OTPs) are an mechanism to improve security over passwords alone.

a collection of security projects

firedrill is a malware simulation harness for evaluating your security controls

A scanner for running security-related configuration checks such as CIS benchmarks