DevSecOps: Part 2
DevOps series:
Docker and Containers: Part1 Overview
Docker and Containers: Part 2 in practice
Docker and containers: Part3 Microservices and Docker compose
Orchestration of the containers: Part 1
Orchestration of the containers: Part 2 Deploying at scale a containerized 3-tier Web Application
Orchestration of the containers: Part3 Enhancing the Kubernetes cluster
CI/CD Pipelines: Part 2 (GitHub Actions in Practice)
Management Tool
For the second part of our DevSecOps series, we’ll dive into the crucial role of management tools in streamlining security practices. As teams implement various security measures like DAST, SAST, SCA, and pre-commit hooks, it becomes increasingly important to have a centralized platform to manage and analyze the flood of reports these tools generate and to aggregate all test reports in one place to facilitate result visualization.
Solution 1: Artifacts
A first solution involves generating reports for the tests and storing them as artifacts.
For SAST: SonarCloud generates a report and stores it in the .scannerwork directory.
For SCA: we just need to add — json with the location where we want to store the report.
Automatically, when Snyk detects vulnerabilities of type “high,” it generates an error, and the pipeline stops. To prevent this, we add “|| true.”
For Container Security: Snyk offers the possibility to generate a report by adding the option — json-file-output with the location where we want to store the report.
For DAST: OWASP ZAP offers the possibility to generate a report by adding the option -J with the location where we want to store the report.
Now, we execute the pipeline.
The pipeline ran smoothly.
In the “Artifacts” section, we notice that all reports are grouped. We can then download them simply by clicking on the artifact and view them.
Reports
For SAST: SonarCloud generates a report that includes a link to the interface.
For SCA: Snyk generates a detailed analysis report.
For Container Security:
For DAST: OWASP ZAP generates two files: a .json file containing the analysis result in JSON format and another .html file allowing us to visualize the result in an interface for easier reading.
Solution 2: DEFECT DOJO
The second solution involves using a tool that automatically retrieves artifacts from the pipeline output and stores them. This eliminates the need for manual downloading.
Get Blogs4devs’s stories in your inbox
Join Medium for free to get updates from this writer.
For this part, we will use DEFECT DOJO.
First, we installe a Docker image of the tool following the instructions provided in the documentation.
We start the container from the installed image.
This allows us to access the DEFECT DOJO interface.
Now, in the pipeline, we add a step at the end of each test job to send the report to this DEFECT DOJO instance. To do this, we need to expose the instance via the Internet. For this purpose, we will use the “Ngrok” tool, which generates a free and secure domain to expose local servers.
First, we need to create an account with Ngrok, then take the generated token. Then, start the tool, giving it the port of DEFECT DOJO, which is 8080.
We create a product in DEFECT DOJO via the interface.
Then we create an engagement.
The engagement ID is 7. We generate a token via the interface and add it to the GitHub repository’s secrets.
Now, we need to add the step that will take the report and send it to DEFECT DOJO at the end of each test:
We specify the Engagement ID (7), the scan type (SonarQube Scan or Snyk Scan or ZAP Scan), the location of the report, and other properties, as indicated in the documentation.
For SAST:
For SCA:
For Container Security:
For DAST:
Now, we execute the pipeline.
We can see that the reports are added successfully.
Wrap up
The pipeline starts when a push is made to the main branch and only when changes are made to specified files in the “angular-16-crud-example-master” directory, except for README files.
The pipeline includes several steps, including static security analysis (SAST) with SonarCloud, dependency analysis with Snyk (SCA), building a Docker image, dynamic security analysis (DAST) with OWASP ZAP, and finally deploying changes to a Kubernetes cluster.
Reports generated by SonarCloud, Snyk SCA, OWASP ZAP, as well as information about Docker image building, are downloaded as artifacts and shared with DefectDojo for vulnerability management.
The pipeline ends with updating Kubernetes deployment configuration files with the newly built Docker image version. These changes are then pushed to the remote Git repository.
After each security analysis, the pipeline can be configured to check the number of detected vulnerabilities. If a fixed threshold is exceeded, rules can be applied to stop the pipeline. This ensures that vulnerabilities are addressed before deploying the application to production.
That concludes this blog. See you in the next one! 👍
