Introduction
As more companies adopt the remote working paradigm, security concerns have skyrocketed. This is an issue in the healthcare and finance industries, which deal with sensitive information. Leaders in the security field warn that serious consequences will follow if corporations do not change their attitudes about data security.
Any effective Software Development Life Cycle (SDLC) transition relies heavily on tools. Different tools fit different stages of the SDLC. During coding and build, SAST, secret detection, and dependency scanning are the most useful. DAST needs a running application, so it fits the test and staging stages.
Application Security Testing
Static Application Security Testing (SAST)
SAST analyzes code statically, so it doesn't need finished or running software (unlike DAST). By analyzing source code, SAST detects vulnerabilities and potential threats. Without running the underlying code, it enforces coding best practices and standards for security.
SAST tools are simple to integrate into a developer's integrated development environment (IDE), such as Eclipse. SQL injection, cross-site scripting (XSS), remote code injection, open redirect, and OWASP Top 10 are some of the rule sets that can help developers find vulnerabilities and other issues right in the IDE. Beyond IDE plugins, SAST can also run at code commit or on each pull request, so reviewers see the findings while they discuss and iterate on the change.
SonarQube and NodeJsScan are two SAST tools we like. SonarQube is the more broadly useful of the two, and one of the most widely used automatic code review tools.
It ships with hundreds of static analysis rules. It supports a wide range of languages, both current and legacy. On pull requests, SonarQube analyzes the branch and reports issues right away.
SpotBugs (the successor to FindBugs) finds bug patterns in Java code. Talisman works differently: it is a pre-commit hook that stops secrets and other sensitive information from leaving the developer's workstation.
SAST tools need tuning for each use case. Plan a few cycles up front to remove false positives and irrelevant checks, so the team can focus on high-severity issues.
Dynamic Application Security Testing (DAST)
DAST detects vulnerabilities in running applications, including common flaws such as SQL injection, cross-site scripting, and the rest of the OWASP Top 10. It can find issues that static analysis misses, such as authentication and server configuration flaws that only show up when a user signs in.
ZAP (formerly OWASP ZAP) is a free and open-source DAST tool that contains automatic vulnerability detection and features to assist professional manual web app pen-testing. ZAP can detect a wide range of flaws.
Secret Detection
GitGuardian has reported finding almost two million “secrets” in public GitHub repositories in a single year. The developers' repositories held 85 percent of the secrets, which were out of company control. GitGuardian CEO Jeremy Thomas is concerned about the consequences of the results. "What's shocking is that a significant percentage of the secrets released on developers' public repositories are company secrets, not personal secrets," he explains.
Secrets that developers leave in repositories are a serious security risk. API keys, database credentials, certificates, passwords, and other sensitive data can all be exposed by accident.
Secret detection tools fix this. They search source code, logs, and other files for secrets left behind by developers. GitGuardian is a good example: it scans repositories for secrets so attackers can't use GitHub as a backdoor into the company. It detects hundreds of secret types, including API keys, database connection strings, private keys and certificates, and passwords.
Dependency Scanning
In 2016, a developer unpublished his packages from npm after a naming dispute over one called kik. One of them was left-pad, an 11-line utility. Builds broke across the JavaScript world, including at large companies, until npm restored the package. A few missing lines of someone else's code stopped thousands of projects.
If libraries and components aren't kept up to date, vulnerabilities pile up. Dependencies cascade: if one card falls, the others fall with it. Libraries, frameworks, and other modules run with the same privileges as your application. Exploit a vulnerable component, and the result can be data loss or a server takeover. Dependency scanning flags components with known vulnerabilities before they reach production.
Runtime Application Self Protection (RASP)
RASP is server-side protection that runs inside the application. It monitors application activity in real time and blocks malicious requests, such as SQL injection, XSS, and SSRF attempts, as they happen. Issues are reported after mitigation for root cause analysis. Because RASP sees how each request actually executes, it can block attacks with fewer false positives than perimeter tools.
Conclusion
Using open-source tools like SonarQube, ZAP, and the Metasploit Framework, alongside commercial tools such as Snyk and Nessus, you can turn your existing DevOps pipeline into a DevSecOps one, one stage at a time.