Why should security testing be implemented in the DevOps process?
DevOps focuses on speedy completion of the development processes for faster delivery of products and services at a higher quality. Not considering security in the development process can leave your application vulnerable to attacks. This is no different than releasing buddy software. For example, stored data could be unencrypted, the code may be vulnerable to buffer overflow, or there might be a data leakage. Vulnerabilities and flaws in a product or a service can be endless if its security has not been considered.
In order to ensure that security is an integral part of DevOps, security testing should be performed on an ongoing basis to keep up with the continuous development. Performing penetration tests manually is not only tedious but it also completely negates the benefits achieved from the DevOps process as it slows the entire development process down. Moreover, due to the huge shortage of security people globally the delays are typically even longer resulting in both vulnerable code and wasted developer time to go back and fix vulnerabilities months after they were introduced.
Automated AI-driven application security tools like Bright solve this problem.
- In addition to solving the issues above, Bright provides 0 false-positive results and gives detailed instructions on how to fix the security issues identified
- By detecting and fixing security issues during the development phases, the speed of delivery is increased resulting in significant cost reduction. Instead of having a pen testing team you can use Bright to reduce costs and ensure better results
- By using Bright companies can keep up with the frantic pace of innovation of cybercrime. Bright enables you to effectively manage security audits, monitor, provide notifications and even discover 0-day vulnerabilities
NOTE: With the huge shortage in security personnel companies are challenged to hire security experts as well as DevOps making NexPloit an ideal solution for overcoming this challenge.
Bright is an AI-Powered Application Security Testing (AIAST) solution, automating the critical thinking process run by a cyber-security specialist to scan any target and find real vulnerabilities, including logical-flow problems, with no false positives.
The Bright extension allows you to harness Bright’s power within your CI. The extension can be downloaded here.
Setting up Bright within the CI/CD Pipeline
Using a pre-recorded HAR file
Upload the file using a simple curl command:
$ curl -X POST “https://nexploit.app/api/v1/files?discard=true”
-H “Content-Type: multipart/form-data”
-H “Authorization: Api-Key yufn0f6.yourapikeykuj069zopv0b1i”
-F “har=@/path/to/the/file.har”
{“ids”:[“6xkFraa5ecfmHhxTEnabZg”]}
This if will then be used for the File ID field. When the setup is complete, the new scan will start automatically and be visible in your Bright account.
NOTE: An active subscription for NexPloit is needed for usage of this extension.
Get an API Key
In Bright Dashboard navigate to the Organization tab and scroll to the Manage your application API keys section.
Press Create new API key button and enter any suitable name (e.g. Azure key)
NOTE: Make sure to backup the API key. It cannot be restored.
What is Azure DevOps?
Azure Pipelines is a fully-featured continuous integration and continuous delivery service.
Languages which are supported with Azure Pipeline are:
Python, Java, JavaScript, PHP, Ruby, C#, C++, and Go which means that any client should be able to use our integration service.
Since Azure supports scripting in all the languages mentioned above, it is not a problem to add Bright to the deployment code. Every client that uses Bright can ensure a better experience to their end-users and be aware of all security issues as soon as they are discovered. With Bright and Azure, you can prevent your applications from going into production with security issues.
Why integrate Bright into your Azure DevOps?
Every day more and more companies fall victim to 0-day exploits and massive data leaks costing millions and millions of dollars. The old method of employing a security team to scan for vulnerabilities is both very costly and has failed companies due to the significant shortage in security personnel and the significant delays in identifying vulnerabilities.
Integrating Bright into your Azure DevOps process solves this problem by allowing a secure and automated approach for adding application security testing into the process.
