Devops Solution – Integrate Security In CI CD Pipeline

The software development industry has witnessed a sea of changes with the advent of DevOps solutions. Thankfully most of these changes have been instrumental for betterment. Software development teams are extensively utilizing these new methodologies. However, the security aspect of the software is often being compromised.

Table of Contents

Addressing the existing problem of Waterfall Model to security

Generally, vulnerability checks are scheduled for execution at the end of the software development process. The usual outcomes of such an approach are extensive documentation and the possibility of massive code rewrites. In a setting where developers are trying their best to enhance value through quick releases, a waterfall model to security seriously falls short to complement and results in slowing down the process. Such friction between teams is undesirable. Manual testing is a time-intensive activity. Developers may not have the necessary tools to thwart the problem in the first instance.

The Benefits of DevOps

A DevOps service provider can render effective solutions to these problems. Before DevOps came into existence, there was a friction of perceptions between developers and the operation team. The operation team was looked upon as an inhibitor of innovation that slows down releases. Developers were considered to be reckless about the cost, reliability, and security of the environment.

Bringing automation with a significant focus on collaboration changes the landscape for good. Operations teams are now a catalyst to deliver added value and render agility to the development process. Now every build is subjected to unit and integration tests. Unless a build is broken after executing a commit, there is no need to send the code to the main branches. With DevOps, the release of new builds has become a normal and frequent event. Together with test automation, it complements shorter feedback cycles. An organization implementing DevOps solutions becomes agile as a whole.

There are instances where these principles are subjected to boundary value analysis as the code is written, integrated and tested in an automated way. A waterfall model to security proves infeasible and undesirable.

The prospect of DevOps for better security

DevOps solution providers have been around for quite some time, and it has been playing its role in optimizing the performance of the software development team. It coined the term DevSecOps that integrates security into the development pipeline.

Challenges and opportunities go hand-in-hand for teams that are willing to embrace the concept of Continuous Integration and Continuous Delivery and implement them through an automated pipeline. The essence of DevSecOps lies in embedding security processes all over the pipeline and implements the DevOps principles to all endeavours related to software security. As security analysis is performed right at the beginning, it somehow mitigates the consequences of security bugs that are uncovered later in the development lifecycle.

Security elements that could be integrated into the pipeline

The security aspects that could be integrated are a variable of the constraints and requirements of the specific product and solutions. InfoSec teams can use a plethora of these to perform their routine jobs. In this regard, mention could be made to Interactive Application Security Testing (IAST), Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), and tools for software composition analysis. Each of these is capable of addressing specific security risks and plays a major role in the agile development life cycle on the grounds of DevOps principle.

In a pipeline, it is possible to integrate both DSAT and SAST providing a cover for runtime vulnerabilities and codebase. On the other hand, SAST solutions like OWASP Find Sec Bugs could be used in earlier stages. You can also integrate them into the developers’ IDE, DSAT tools like ZAP or Arachni. It supports automated deployment during the build step.

A look to the security techniques that could be inserted in the pipeline

You can use the software composition analysis tool to check the imported libraries. For instance, you can use the Retire.js or OWASP Dependency-Check for detecting licensing risks and other weaknesses related to the open-source libraries that are used by developers.

Use of cloud-based tools like Nmap or Inspec for hardening and analyzing the infrastructure.
Using solutions like got-secrets.
Using SSLyze, SQLMap, and others to target specific issues.
Open source tools can be automated through a common interface with wrappers like Gauntlt and OWASP Glue.

Conclusion

The tools discussed above are available on an open-source license. However, there are commercial solutions too. They are offered at a cost and can serve you with additional features and detailed reports. It is possible to plug them in the CI/CD pipeline. It is important to keep in mind that the implementation of a complete security chain can be challenging and there is a possibility of a pushback. You have to take care that every new step added in the pipeline is rendering value and accepted by the team and all stakeholders.