CI/CD 是現在企業常用的開發流程，敏捷的開發速度自然需要自動化的流程幫助我們加速驗證和部署。但為了求快速，資安測試和檢查往往在開發流程中會被捨去。 議題會大致分成兩大部分：資安測試以及 DevSecOps。 這次議題內容會講解如何在現有的 DevOps 開發文化中，加上自動化的資安測試。會介紹像是靜態測試（SAST）和動態測試（DAST），以及要套用哪些標準來提升測試的價值。並且以自身經驗，跟大家分享要導入這些資安測試時，在 CI/CD 每個階段不同的需求和做法。 同時也會簡單介紹 DevSecOps，希望能將資安融入在快速、敏捷開發的文化中，讓產品可以不斷推進，產品也可以持續保持在足夠的安全性上。

1. 從零開始加入⾃自動化資安測試
YSc
Modern Web 2019

2. – AWS CTO Werner Vogels
Security is EVERYONE's job

3. DevOps

4. DevSecOps

5. YSc
• HITCON Speaker & Trainer
• Balsn CTF Team Co-Founder
• Bug Bounty Hunter
• Security Engineer in Appier and COBINHOOD
• ⽩白帽觀點 https://secview.io/
ｙ

6. https://balsn.tw
Balsn CTF 10/5 ~ 10/7

7. HardeningSecurity TestingPreparation
• 商業價值
• 標準化
• 風險評估
• 威脅模型
• 測試範圍
• OWASP Testing Guide V4
• 測試⾃自動化
• ⾃自動化過濾
• 弱點分析、回報
• 資安測試優化

8. 威脅模型
• （What）你要保護什什麼？⾦金金鑰？客⼾戶資料？
• （Who）誰會攻擊？Script Kiddie？
• （Where）從哪攻擊？網站？功能？⼈人？
• （How）怎麼攻擊？開源⼯工具掃描？社交⼯工程？
Business
Impact
What
Where Who

9. OWASP
Testing Guide V4
https://www.owasp.org/index.php/
OWASP_Testing_Guide_v4_Table_of_Contents

10. 靜態資安測試
（SAST）
動態資安測試
（DAST）

11. 標準化
• 威脅模型（Threat Modeling）
• STRIDE、PASTA、...
• 資安測試（Security Testing）
• OWASP Testing Guide V4
• OWASP ASVS 3.0
• 弱點評估（Vulnerability Assessment）
• Common Vulnerability Scoring System (CVSS) 3.0

12. Web Vulnerabilities ?

13. AWS S3
Information Leak
https://github.com/nagwww/s3-leaks

14. SSRF to Root Access
https://hackerone.com/reports/341876

16. • Information Gathering
• Configuration and Deploy Management Testing
• Identity Management Testing
• Authentication Testing
• Authorization Testing
• Session Management Testing
• Data Validation Testing
• Error Handling
• Cryptography
• Business Logic Testing
• Client Side Testing

17. • Information Gathering
• Configuration and Deploy Management Testing
• Identity Management Testing
• Authentication Testing
• Authorization Testing
• Session Management Testing
• Data Validation Testing
• Error Handling
• Cryptography
• Business Logic Testing
• Client Side Testing
• Shodan: https://www.shodan.io/
• Censys: https://censys.io/
• Sublist3r: https://github.com/aboul3la/Sublist3r
• Nmap: https://nmap.org/

18. • Information Gathering
• Configuration and Deploy Management Testing
• Identity Management Testing
• Authentication Testing
• Authorization Testing
• Session Management Testing
• Data Validation Testing
• Error Handling
• Cryptography
• Business Logic Testing
• Client Side Testing
• Kube Hunter: https://github.com/aquasecurity/
kube-hunter
• Nginx configuration: https://github.com/yandex/
gixy
• SSLScan: https://github.com/rbsec/sslscan

19. • Information Gathering
• Configuration and Deploy Management Testing
• Identity Management Testing
• Authentication Testing
• Authorization Testing
• Session Management Testing
• Data Validation Testing
• Error Handling
• Cryptography
• Business Logic Testing
• Client Side Testing
• SAST Tools
• Python: https://github.com/PyCQA/bandit
• Go: https://github.com/securego/gosec
• ...

20. • Information Gathering
• Configuration and Deploy Management Testing
• Identity Management Testing
• Authentication Testing
• Authorization Testing
• Session Management Testing
• Data Validation Testing
• Error Handling
• Cryptography
• Business Logic Testing
• Client Side Testing
• DAST Tools
• OWASP ZAP: https://github.com/zaproxy/
zaproxy/wiki/ZAP-API-Scan
• Nitkto2: https://github.com/sullo/nikto
• Sqlmap: https://github.com/sqlmapproject/
sqlmap
• Arachni: https://github.com/Arachni/arachni
• Behave: https://github.com/behave/behave

21. • Information Gathering
• Configuration and Deploy Management Testing
• Identity Management Testing
• Authentication Testing
• Authorization Testing
• Session Management Testing
• Data Validation Testing
• Error Handling
• Cryptography
• Business Logic Testing
• Client Side Testing
• Software Composition Analysis (SCA)
• JS libraries: https://retirejs.github.io/retire.js/
• 3rd party libraries: https://snyk.io/
• Container analysis: https://github.com/coreos/
clair
• Vuls: https://github.com/future-architect/vuls

22. ⾃自動化？

23. DevSecOps

24. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy

25. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Runtime Application Self-
Protection (RASP)
Security Architecture Design
Static Application Security
Testing (SAST)
Security Code Review
Dynamic Application Security
Testing (DAST)
Interactive Application
Security Testing (IAST)
Software Composition
Analysis (SCA)

26. Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Static Application Security
Testing (SAST)
Dynamic Application Security
Testing (DAST)
Software Composition
Analysis (SCA)
CI
CD

27. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy

28. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Security Architecture Design

29. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Runtime Application Self-
Protection (RASP)
Security Architecture Design

30. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Runtime Application Self-
Protection (RASP)
Security Architecture Design
Static Application Security
Testing (SAST)

31. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Runtime Application Self-
Protection (RASP)
Security Architecture Design
Static Application Security
Testing (SAST)
Security Code Review

32. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Runtime Application Self-
Protection (RASP)
Security Architecture Design
Static Application Security
Testing (SAST)
Security Code Review
Software Composition
Analysis (SCA)

33. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Runtime Application Self-
Protection (RASP)
Security Architecture Design
Static Application Security
Testing (SAST)
Security Code Review
Dynamic Application Security
Testing (DAST)
Software Composition
Analysis (SCA)

34. CI
CD
Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Runtime Application Self-
Protection (RASP)
Security Architecture Design
Static Application Security
Testing (SAST)
Security Code Review
Dynamic Application Security
Testing (DAST)
Interactive Application
Security Testing (IAST)
Software Composition
Analysis (SCA)

35. 預防
⾃自動化測試
滲透測試
漏洞洞獎勵計劃
未找到
利利⽤用

36. Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Static Application Security
Testing (SAST)
Dynamic Application Security
Testing (DAST)
Software Composition
Analysis (SCA)
CI
CD

37. Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Static Application Security
Testing (SAST)
Dynamic Application Security
Testing (DAST)
Software Composition
Analysis (SCA)
CI
CD
動態資安測試（DAST）
• 輸入驗證測試
• 資訊收集、部署、認證授權測試
• 降低報告的內容和數量量
軟體組件分析（SCA）
• 相依性套件
• 第三⽅方函式庫、開發框架、
Docker 映象檔、系統軟體套件
靜態資安測試（SAST）
• Security linter、錯誤配置檢測
• 需要低偽陽性（False Positive）
• 快速檢查

38. Design Code Commit CI Tests Code Review
Release Prod Deploy Tests Stage Deploy
Static Application Security
Testing (SAST)
Dynamic Application Security
Testing (DAST)
Software Composition
Analysis (SCA)
CI
CD
• Python: https://github.com/
PyCQA/bandit
• Go: https://github.com/
securego/gosec
• Nginx configuration: https://
github.com/yandex/gixy
• ZAP、Nikto 2、Sqlmap、
Arachni
• https://github.com/
infobyte/faraday/wiki/
Plugin-List#list
• https://
defectdojo.readthedocs.io/
en/latest/integrations.html
• JS libraries: https://
retirejs.github.io/retire.js/
• 3rd party libraries: https://
snyk.io/
• Container analysis
動態資安測試（DAST） 軟體組件分析（SCA）靜態資安測試（SAST）

39. 漏洞洞管理理
• ⾃自動化過濾（Filter）
• 偽陽性、重複掃到的問題（Duplicate Issues）
• 嚴重性評估（Assess）
• CVSS 3.0
• 報告（Report）
• 嚴重性、優先順序、漏洞洞簡介、漏洞洞影響
• 建議修復⽅方法
• DefectDojo: https://github.com/DefectDojo/django-DefectDojo
• Archery: https://github.com/archerysec/archerysec
Filter
Assess
Report

40. HardeningSecurity TestingPreparation
• 商業價值
• 標準化
• 風險評估
• 威脅模型
• 測試範圍
• OWASP Testing Guide V4
• 測試⾃自動化
• ⾃自動化過濾
• 弱點分析、回報
• 資安測試優化

41. 由上⽽而下 由內⽽而外

42. ⽩白帽觀點
https://secview.io

43. Thanks