Explore DevSecOps CI/CD security scanning to find vulnerabilities in code, dependencies, infrastructure, and containers before deployment.
CI/CD Security Scanning enables teams to discover vulnerabilities before they impact production. Scans code, dependencies, infrastructure and containers for security problems. This minimizes the potential for security breaches or compliance issues, as well as cyberattacks, while also helping with DevSecOps practices.
An Overview
Types of CI/CD Security Scanning
1. SAST
Static Application Security Testing (SAST) is a test performed on source code without the application running. It can identify SQL injection, XSS, insecure coding practices and hardcoded credentials.
2. SCA
Software Composition Analysis (SCA) analyses open-source software (OSS), software frameworks and third-party packages for known vulnerabilities, outdated versions, and license problems.
3. DAST
Dynamic Application Security Testing (DAST) tests a running application by simulating attacks. It can detect authentication problems, session control problems, and security misconfigurations.
4. IaC Scanning
Infrastructure as Code (IaC) scanning verifies IaC files that are deployed by infrastructure tools like Terraform and Kubernetes. It can detect insecure configurations, over-privilege, and compliance problems prior to deployment.
Secure Your CI/CD Pipeline.
5. Container Security Scanning
Container scanning inspects container images for vulnerabilities, such as packages, base images, application dependencies, and others.
Best Practices for CI/CD Security Scanning
- Shift security left: Do security checks early in development to enable teams to correct issues earlier.
- Automate security scans: Deploy scans as part of the CI/CD pipeline and execute scans when code and configuration change.
- Prioritize high-risk issues: Deal with high-severity vulnerabilities and issues that may impact business operations first.
- Protect dependencies and secrets: Ensure that third-party packages are up-to-date and check for exposed API keys, passwords, and access tokens.
- Monitor continuously: There is a need to monitor after deployment, as new vulnerabilities and configuration issues can emerge over time.
CI/CD Security Scanning at a Glance
| Scan | Checks |
|---|---|
| SAST | Source code |
| SCA | Dependencies |
| DAST | Running applications |
| IaC | Infrastructure settings |
| Container Scanning | Container components |
Conclusion
Security scanning is different when using CI/CD, as it scans various aspects of an application at various points. Teams are better able to identify vulnerabilities with SAST, SCA, DAST scanning, IaC scanning and container scanning. These checks, along with automated scans, risk prioritization, secret protection, and ongoing monitoring, contribute to a more secure CI/CD process.
