Hands-On Security in DevOps

Security in continuous integration

Most of the development team's daily activities include coding, compiling/building, testing, and deployment. Our goal is to build security automation practices into these activities. In the coding stage, the development team can use IDE plugins to do security source code analysis. In the build stage, we scan for the secure hardened compiling options and the known vulnerabilities of the dependency components, as well as the secure source code for the whole project.

Once the build is ready and installed on the staging environment, more comprehensive security scanning will be performed, such as dynamic web security testing by OWASP ZAP, infrastructure configuration security, and secure communication protocols. ...