Implementing Security Scans Into DevOps
Implementing Security Scans Into DevOps
Learn why it's so important to integrate security scans into your DevOps process when developing your apps, and a few tools for doing so.
Join the DZone community and get the full member experience.
Join For FreeLearn how integrating security into DevOps to deliver "DevSecOps" requires changing mindsets, processes and technology.
Application-level security will always be the development team's responsibility. Implementing and integrating security scans for your application in the CI phase of DevOps is important, and it's critical for financial applications which are customer-facing. There are a few tools available on the market to accomplish this, some free and others paid.
Cybersecurity is a highly focused area and there are specialized teams working on this. For this article, we will only be keeping our focus on application security.
For continuous integration, I will only be focusing on Jenkins because it's the most popular tool and it's easier to integrate most of the scanning tools with Jenkins using plugins.
Sonarqube
Sonarqube scans are primarily used for software quality scans, but can also run some basic security checks. It's important for teams to use an initial scan as a baseline to improve code quality aspects like technical debt, duplicate code, etc. with each progressive release.
Implementation With Jenkins
https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner+for+Jenkins
The standard for most rules implemented in SonarQube scans are very strict, no false positives. For normal rules, you should be able to be confident that whatever is reported to you as an issue really is an issue.
Veracode
Veracode provides cloud-based scanning for your application code. Since nowadays, developers are using a lot of opensource/freeware packages, it's important to scan your code for vulnerabilities.
Integration With Jenkins
https://help.veracode.com/reader/PgbNZUD7j8aY7iG~hQZWxQ/tO0QQBewkwZzU03rMut9Pw
Fortify
Fortify is another market-leading tool in continuous application scanning.
Implementation With Jenkins
https://wiki.jenkins.io/display/JENKINS/Fortify+On+Demand+Uploader+Plugin
It will depend on a lot of factors on what tool you and your enterprise choose, but there are a few important considerations as a part of DevOps:
Implement in parallel : Keep your DevOps process as fast as possible and make sure you implement any continuous scanning processes in parallel. This way, it won't increase your time to go to production. Time to market is one of the most important success factors for DevOps.
Create a baseline: There is a good chance that you will find a lot of false positives in your initial scans, especially for your legacy applications. Make a baseline of acceptable issues and only focus on any new vulnerabilities going forward. This will save you lot of effort; some false positives will be related to architectural choices made a long time ago.
Secure code review process: You need to have a process to review all the security issues that will come up with each scan. Also, you need to integrate secure code review processes with CI. Tools like Jira can help you come up with a secure code review process.
There are some other cloud-based scanning tools/solutions that have come up recently, like Google Cloud, but I have not tried them yet.
Feel free to reach out to me if you have any questions on this approach.
Learn how enterprises are using tools to automate security in their DevOps toolchain with these DevSecOps Reference Architectures.
Like This Article? Read More From DZone
Opinions expressed by DZone contributors are their own.
{{ parent.title || parent.header.title}}
{{ parent.tldr }}
{{ parent.linkDescription }}
{{ parent.urlSource.name }}