AUTOMATING SECURITY SCANS IN CI/CD PIPELINES

WHY SECURITY IN CI/CD?

Shift-left security means catching vulnerabilities early in the development lifecycle, reducing costs and risks.

TOOLS AND INTEGRATION

1. SAST (STATIC APPLICATION SECURITY TESTING)

CODE_BLOCK // YAML
# .github/workflows/security.yml
name: Security Scan

on: [push, pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1

2. DEPENDENCY SCANNING

CODE_BLOCK // YAML
- name: Run Snyk
  uses: snyk/actions/node@master
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

3. CONTAINER SCANNING

CODE_BLOCK // BASH
# Scan Docker images
trivy image myapp:latest --severity HIGH,CRITICAL

4. DAST (DYNAMIC APPLICATION SECURITY TESTING)

CODE_BLOCK // YAML
- name: OWASP ZAP Scan
  uses: zaproxy/action-baseline@v0.7.0
  with:
    target: 'https://staging.example.com'

BEST PRACTICES

1. Fail Fast: Break builds on critical vulnerabilities
2. Gradual Rollout: Start with warnings, then enforce
3. False Positive Management: Maintain suppression lists
4. Regular Updates: Keep scanning tools updated

EXAMPLE PIPELINE

CODE_BLOCK // YAML
stages:
  - lint
  - test
  - security
  - build
  - deploy

security:
  stage: security
  script:
    - npm audit --audit-level=high
    - semgrep --config=auto
    - trivy fs .
  allow_failure: false

METRICS AND REPORTING

Track security metrics:

• Vulnerabilities found per build
• Time to remediation
• False positive rate
• Coverage percentage

CONCLUSION

Automated security scanning is essential for modern DevOps. Integrate multiple tools, tune for your environment, and continuously improve.