What is DevSecOps? How to Automate Security Testing

Every company wants to see their company getting press and media attention. Unless it is due to a hacker and a security breach. Every few weeks you see in the media stories of companies who were hacked. Getting a new credit card every few months because the data was hacked has been routine for most of us. The more that our world revolves around the internet and technology, the more cyber security becomes a big deal.

Software applications are complex and can potentially have lots of different types of security issues. The issues range from bad code to misconfigured servers and everything in between. Solving this problem requires everyone to always be thinking about security implications of what they are working on. DevSecOps is a new movement to do just that. The goal is to get developers to be thinking more about security principles and standards as they are building their applications.

Integrating DevOps + Security = DevSecOps

The goal of DevOps is to give development teams more ownership in deploying and monitoring their applications. Automating how we provision servers and deploy our applications is at the heart of DevOps. Automation helps us move faster and ship higher quality products.

Adding security to this same automation is the goal of DevSecOps. Companies want to create strong security policies and standards without slowing down the development process. Security has to be part of the process and automated to not slow us down.

Things like DevOps and DevSecOps continue to change the meaning of the software development life cycle (SDLC). This image does a good job of visualizing it.

Tools for Automating Security Testing

One of the goals of DevSecOps is to build security testing into your development process. There are new tools that can be used to help achieve and automate it across the development lifecycle. Here are some of the types of tools that exist:

Cloud infrastructure best practices – Tools built into the cloud like Microsoft Azure Advisor and third party tools like evident.io can help scan your configurations for security best practices.
Automate security tests – You can now create and run automated security tests just like you would unit tests or integration tests. Gauntlt is a popular free framework for automated these types of tests.
Code Analysis – Tools like Veracode can scan your code to find potential vulnerabilities in your own code and open source libraries.
Runtime application security – Tools like Contrast Security run within your application in production and can help identify and prevent security issues in real time.

Hopefully, this gives you some ideas of the types of security testing and automation that can be built into your development process. Check out this list on GitHub which provides a huge list of tools and resources.

Security Unit Tests

Application security is something that needs to be thought of when we start writing code. Just as we write and run unit tests, running some automated security tests can help ensure new vulnerabilities were not introduced. Gauntlt provides some neat capabilities around this.

For example, as part of your deployment process perhaps you provision new servers or deploy some Docker containers. You could then automatically run some various basic security tests.

Scan for open ports on your server
Test to see if your server responds to pings or not
Do an HTTP request and validate the cookies in the response
Test various HTTP verbs. Is it supposed to support DELETE, PATCH, etc?

Conclusion

Software and automation continue to change our world. Automation within the software development lifecycle helps us ship our code faster and at a higher quality. Adding security testing into that automation will also help us create more secure applications. DevSecOps is still a new thing and is evolving quickly. Hopefully, this article gave you a few ideas you can use in the future to improve the security of your apps.

Recommended Resources:

About the Author
Latest Posts

About Matt Watson

Matt is the Founder & CEO of Stackify. He has been a developer/hacker for over 15 years and loves solving hard problems with code. While working in IT management he realized how much of his time was wasted trying to put out production fires without the right tools. He founded Stackify in 2012 to create an easy to use set of tools for developers.