Implementing Security Scans Into DevOps

Application-level security will always be the development team's responsibility. Implementing and integrating security scans for your application in the CI phase of DevOps is important, and it's critical for financial applications which are customer-facing. There are a few tools available on the market to accomplish this, some free and others paid. 

Cybersecurity is a highly focused area and there are specialized teams working on this. For this article, we will only be keeping our focus on application security.

For continuous integration, I will only be focusing on Jenkins because it's the most popular tool and it's easier to integrate most of the scanning tools with Jenkins using plugins.

Sonarqube

Sonarqube scans are primarily used for software quality scans, but can also run some basic security checks. It's important for teams to use an initial scan as a baseline to improve code quality aspects like technical debt, duplicate code, etc. with each progressive release.

Implementation With Jenkins 

 https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner+for+Jenkins

The standard for most rules implemented in SonarQube scans are very strict, no false positives. For normal rules, you should be able to be confident that whatever is reported to you as an issue really is an issue.

Veracode

Veracode provides cloud-based scanning for your application code. Since nowadays, developers are using a lot of opensource/freeware packages, it's important to scan your code for vulnerabilities.

Integration With Jenkins

https://help.veracode.com/reader/PgbNZUD7j8aY7iG~hQZWxQ/tO0QQBewkwZzU03rMut9Pw

Fortify

Fortify is another market-leading tool in continuous application scanning.

Implementation With Jenkins 

https://wiki.jenkins.io/display/JENKINS/Fortify+On+Demand+Uploader+Plugin

It will depend on a lot of factors on what tool you and your enterprise choose, but there are a few important considerations as a part of DevOps:

• Implement in parallel : Keep your DevOps process as fast as possible and make sure you implement any continuous scanning processes in parallel. This way, it won't increase your time to go to production. Time to market is one of the most important success factors for DevOps.

• Create a baseline: There is a good chance that you will find a lot of false positives in your initial scans, especially for your legacy applications. Make a baseline of acceptable issues and only focus on any new vulnerabilities going forward. This will save you lot of effort; some false positives will be related to architectural choices made a long time ago. 

• Secure code review process: You need to have a process to review all the security issues that will come up with each scan. Also, you need to integrate secure code review processes with CI. Tools like Jira can help you come up with a secure code review process.  

There are some other cloud-based scanning tools/solutions that have come up recently, like Google Cloud, but I have not tried them yet.

Feel free to reach out to me if you have any questions on this approach.