DZone
DevOps Zone
Thanks for visiting DZone today,
Edit Profile
  • Manage Email Subscriptions
  • How to Post to DZone
  • Article Submission Guidelines
Sign Out View Profile
  • Post an Article
  • Manage My Drafts
Over 2 million developers have joined DZone.
Log In / Join
  • Refcardz
  • Trend Reports
  • Webinars
  • Zones
  • |
    • Agile
    • AI
    • Big Data
    • Cloud
    • Database
    • DevOps
    • Integration
    • IoT
    • Java
    • Microservices
    • Open Source
    • Performance
    • Security
    • Web Dev
DZone > DevOps Zone > Implementing Security Scans Into DevOps

Implementing Security Scans Into DevOps

Learn why it's so important to integrate security scans into your DevOps process when developing your apps, and a few tools for doing so.

Vijay Sharma user avatar by
Vijay Sharma
·
Oct. 24, 17 · DevOps Zone · Opinion
Like (4)
Save
Tweet
9.03K Views

Join the DZone community and get the full member experience.

Join For Free

Application-level security will always be the development team's responsibility. Implementing and integrating security scans for your application in the CI phase of DevOps is important, and it's critical for financial applications which are customer-facing. There are a few tools available on the market to accomplish this, some free and others paid. 

Cybersecurity is a highly focused area and there are specialized teams working on this. For this article, we will only be keeping our focus on application security.

For continuous integration, I will only be focusing on Jenkins because it's the most popular tool and it's easier to integrate most of the scanning tools with Jenkins using plugins.

Sonarqube

Sonarqube scans are primarily used for software quality scans, but can also run some basic security checks. It's important for teams to use an initial scan as a baseline to improve code quality aspects like technical debt, duplicate code, etc. with each progressive release.

Image title

Implementation With Jenkins 

 https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner+for+Jenkins

The standard for most rules implemented in SonarQube scans are very strict, no false positives. For normal rules, you should be able to be confident that whatever is reported to you as an issue really is an issue.

Veracode

Veracode provides cloud-based scanning for your application code. Since nowadays, developers are using a lot of opensource/freeware packages, it's important to scan your code for vulnerabilities.

Integration With Jenkins

https://help.veracode.com/reader/PgbNZUD7j8aY7iG~hQZWxQ/tO0QQBewkwZzU03rMut9Pw

Image title

Fortify

Fortify is another market-leading tool in continuous application scanning.

Implementation With Jenkins 

https://wiki.jenkins.io/display/JENKINS/Fortify+On+Demand+Uploader+Plugin

It will depend on a lot of factors on what tool you and your enterprise choose, but there are a few important considerations as a part of DevOps:

  • Implement in parallel : Keep your DevOps process as fast as possible and make sure you implement any continuous scanning processes in parallel. This way, it won't increase your time to go to production. Time to market is one of the most important success factors for DevOps.

  • Create a baseline: There is a good chance that you will find a lot of false positives in your initial scans, especially for your legacy applications. Make a baseline of acceptable issues and only focus on any new vulnerabilities going forward. This will save you lot of effort; some false positives will be related to architectural choices made a long time ago. 

  • Secure code review process: You need to have a process to review all the security issues that will come up with each scan. Also, you need to integrate secure code review processes with CI. Tools like Jira can help you come up with a secure code review process.  

There are some other cloud-based scanning tools/solutions that have come up recently, like Google Cloud, but I have not tried them yet.

Feel free to reach out to me if you have any questions on this approach.

security DevOps application

Opinions expressed by DZone contributors are their own.

Popular on DZone

  • 10 Books Every Senior Engineer Should Read
  • 6 Best Books to Learn Multithreading and Concurrency in Java
  • Querying Kafka Topics Using Presto
  • Maven Tutorial: Nice and Easy [Video]

Comments

DevOps Partner Resources

ABOUT US

  • About DZone
  • Send feedback
  • Careers
  • Sitemap

ADVERTISE

  • Advertise with DZone

CONTRIBUTE ON DZONE

  • Article Submission Guidelines
  • MVB Program
  • Become a Contributor
  • Visit the Writers' Zone

LEGAL

  • Terms of Service
  • Privacy Policy

CONTACT US

  • 600 Park Offices Drive
  • Suite 300
  • Durham, NC 27709
  • support@dzone.com
  • +1 (919) 678-0300

Let's be friends:

DZone.com is powered by 

AnswerHub logo