Shift-left security dengan DevSecOps. Pelajari cara mengintegrasikan security testing otomatis ke setiap tahap development pipeline.
Apa Itu DevSecOps?
DevSecOps adalah filosofi yang mengintegrasikan keamanan ke dalam setiap fase software development lifecycle (SDLC), bukan menambahkannya di akhir.
Security di Setiap Fase
Planning & Design
- Threat modeling (STRIDE, PASTA)
- Security requirements gathering
- Architecture review
Coding
- Secure coding guidelines
- IDE security plugins (Snyk, SonarLint)
- Pre-commit hooks untuk secret scanning
Build & CI
- SAST (Static Application Security Testing): SonarQube, Semgrep, CodeQL
- SCA (Software Composition Analysis): Snyk, Dependabot, Trivy
- Secret Detection: Gitleaks, TruffleHog
- Container Image Scanning: Trivy, Grype
Testing & QA
- DAST (Dynamic Application Security Testing): OWASP ZAP, Nuclei
- IAST (Interactive AST): Check Markeplace
- API Security Testing: Postman, REST Assured
Deployment & Monitoring
- Infrastructure as Code scanning (tfsec, checkov)
- Runtime Application Self-Protection (RASP)
- WAF (Web Application Firewall)
- SIEM & alerting
Metrics DevSecOps
Track: Mean Time to Remediate (MTTR), vulnerability density, percentage of builds failed by security, coverage of security testing.