Downloaded 246 times
Uploaded byStephen de Vries
Automating security tests for Continuous Integration
The document discusses automating security tests within continuous integration frameworks, emphasizing the need for collaboration between security, development, and operations teams. It highlights the importance of fast feedback cycles, ownership of security tests by cross-functional teams, and the use of automated testing tools integrated with existing CI/CD practices. Additionally, it details various tools and frameworks available for security testing, such as BDD-security and OWASP ZAP, to enhance security throughout the software development lifecycle.
More Related Content
Similar to Automating security tests for Continuous Integration
Automating security tests for Continuous Integration
- 1. Automating Security Testsfor Continuous Integration Stephen de Vries @stephendv www.continuumsecurity.net
- 2. About Continuum Security •Founded 2012 • Services: Security Testing, BDD-Security jump start • Products: Securing the SDLC – Open Source • BDD-Security Testing Framework • OWASP ZAP integration with JUnit • Nessus Java client API – Commercial • IriusRisk Risk Management for Application Security: www.iriusrisk.com
- 3. Security Testing • Performedafter build • Uses external testers • Process is opaque to dev/opts Unit/Integration/Functiona l Testing • Performed during build • Owned by dev/test • Tests visible to the team
- 4. Design Build Unit Tests Integration Tests Acceptance Tests Deploy Development Pre-prodProduction Agile • Short iterative cycles • Extensive automated testing • Low/zero cost to test • Tests can replace documentation Security Testing Waterfall
- 5. Design Build Unit Tests Integration Tests Acceptance Tests Deploy Development Pre-prodProduction Continuous Delivery with DevOps • Automated delivery into pre-prod • Automated acceptance tests
- 6. Design Build Unit Tests Integration Tests Acceptance Tests Deploy Development Pre-prodProduction Continuous Deployment with DevOps Security Testing • Etsy: 50+ deploys per day • Amazon: 300+ per hour • Gov.uk: 10+ deploys per day
- 7. • Everyone isresponsible for • Move testing closer to the code • Continuous automated testing • Tests are visible to the team quality quality security security ^
- 8. Design Build Integration TestsUnit Tests Acceptance Tests Deploy DevelopmentPre-prod Production Continuous Deployment with SecDevOps: Blocking tests
- 9. Design Build IntegrationTests Unit Tests Acceptance Tests Deploy Development Pre-prod Production Continuous Deployment with Semi-SecDevOps: Parallel tests
- 10. Who owns thesecurity tests? A) Security team • Benefits of automation • Fast feedback • Poor collaboration • Lack of ownership by DevOps
- 11. Who owns thesecurity tests? B) DevOps team with oversight by Security • Better collaboration • More sense of ownership of security • Good stepping stone to…
- 12. Who owns thesecurity tests? C) Sec + Dev + Ops in a cross-functional team • Security testing is our problem • We have the tools and skills to manage it
- 13. Automated Security Testsshould: • return either a pass or fail result • execute quickly (similar to acceptance tests) • test infrastructure and application tiers • test functional security features, e.g. Login, Password Reset • capture manual testing processes and automate them, i.e. security regression tests • be checked into version control along with the code • be understandable by the whole team
- 14. BDD-Security Testing Framework https://github.com/continuumsecurity/bdd-security BDD-Security= JBehave + OWASP ZAP + Nessus + Internal security tools + Pre-written baseline security specifications Selenium +
- 15.
- 18.
- 19. HTTP/S Proxy Manual ApplicationSecurity Testing with OWASP ZAP
- 20. HTTP/S Proxy Manual ApplicationSecurity Testing with OWASP ZAP ^ BDD-Security
- 23.
- 24. Integrating with Jenkins •Configuration • Test run
- 25. Summary • Security testingis just another form of software testing • Automate as much as possible for faster feedback • Security Tests can be treated as security requirements • Self Verifying Requirements! • Tests written in a BDD language foster collaboration between sec, dev and ops • Automated Security tests should include more than just scanning
- 26. Other related tools •Mittn (Python + Burp Intruder) https://github.com/F-Secure/mittn • ZAP-JUnit (Java) https://github.com/continuumsecurity/zap-webdriver • Guantlet (Ruby) http://gauntlt.org/ • OWASP ZAP Jenkins plugin https://wiki.jenkins- ci.org/display/JENKINS/Zapper+Plugin
- 27.
Editor's Notes
- #2 Story: There is a gap between sec testing and every other type of software testing Sec is still stuck in waterfall model History of testing and sec testing Benefits of agile, fast feedback, low cost tests = run them more often TDD and BDD: Tests as communication mechanism DevOps is Agile for the rest of the organisation Don’t need to look far to find answers to integrating security into dev: quality Sec testing is subset Security testing > automated scanning Security testing > Penetration Testing BDD-Sec intro: objectives. Default set of security tests + allows building more specific tests
- #4 There is a considerable gap between how we use security testing and how we use almost every other type of software test.
- #5 The first great leap forward for software testing was Agile But even though we had this benefit of fast feedback, it was constrained to the dev environment.
- #6 …there’s a manual step before deploying into production.
- #7 All security testing, automated scans and manual penetration testing.
- #8 And looking at how testing has evolved over time two things stand out: we’re doing more automation, and we’re doing that automated testing closer to the code. Our unit and integration tests are a key part to making continuous delivery possible. And I claim that that we can and should take the same approach with security testing: automated as much as possible, so that we can run them continuously and get feedback as quick as possible. Not to replace manual security testing, but to complement it.
- #9 The primary control is the automated security tests, the secondary control is the manual tests.
- #10 Automated tests can run in parallel, but at same pace as integration tests.
- #14 The first activity that springs to mind when talking about automated security testing is probably scanning.
- #15 BDD Behaviour Driven Development
- #18 False positives
- #19 From
- #24 From
- #25 From