CNCF meetup 21. kubernetes.

1. Integrate Security into CI/CD
Andrej Krnáč

2. ● Agile and Security
● Vulnerability management
● Application security testing methodologies
● CI/CD pipeline phases with integrated security checks
● Demo
● Limitations of tools
● Final thoughts
Agenda

3. Agile and Security
● Agile development and Security
● Manual testing and compliance checking cannot keep up with
the speed of delivery
● Security teams that try to reduce risk by minimizing change are
irrelevant in an Agile world
● Instead of doing security, enable security (DevSecOps)
○ Document techniques
○ Build capability to develop and deploy secure services
○ Build tools and automation

4. Vulnerability management
● Vulnerability scanning and patching
● Some ways of getting vulnerability information:
○ Automated Security Testing (AST) tools
○ Software Component Analysis (SCA) tools
○ Scanning container images
○ Scanning cloud instances (AWS Inspector)
○ Bug reports from partners, users, …
○ ...
● Automate and streamline scanning and run it often - as part of
build pipelines
● The information should be consolidated, tracked and reported
● Handle vulnerabilities as any other software defects - “Shift Left”
to reduce the cost of defects

5. Application security testing methodologies
● SAST (Static Application Security Testing)
● SCA (Software Composition Analysis)
● DAST (Dynamic Application Security Testing)
● Negative Unit Testing
● Difficult to automate:
○ Penetration testing
○ API fuzzing

7. Demo
● Many tools available
○ SAST
○ DAST
● Demo
○ pre-commit - detect-secrets
■ https://github.com/adys/nodejs-security-demo/pull/1
○ npm audit
■ https://github.com/adys/nodejs-security-demo/pull/2
○ NodejsScan

8. Limitations of tools
● Automated web vulnerability scans run through a set of
well-known attacks and look for well-known vulnerabilities and
common mistakes
● Can't find holes in business logic
● Some types of vulnerabilities are difficult to detect such as
authentication problems, access control issues
● Understand what you are getting out of the tools and how much
you can rely on them

9. Final thoughts
● Tools that require significant effort from developers will end up
not being used
○ Long output with irrelevant information
● Handle false positives
● Do not introduce a new scan to pipelines without setting a
baseline first
● Avoid disruption
● Roll out incrementally (one aspect at a time, get feedback while
iterating)
● Do not stop with the automated security testing

10. Thank you
Andrej Krnáč
Cloud Architect
Contact:
andrej.krnac@lablabs.io