Enhancing application security through DevSecOps : a comprehensive study on vulnerability detection and management in continuous integration and continuous delivery pipelines
Βελτιστοποίηση της ασφάλειας εφαρμογών μέσω DevSecOps : μια έρευνα σχετικά με τον εντοπισμό και τη διαχείριση των ευπαθειών, με τη βοήθεια εργαλείων σε ένα περιβάλλον συνεχούς ενσωμάτωσης και συνεχούς παράδοσης
View/
Abstract
This thesis examines the intersection of software development methods and cybersecurity in the domain of DevSecOps, a paradigm that prioritizes the incorporation of security measures across the entire Software Development Lifecycle (SDLC). This paper explores the difficulties associated with implementing DevSecOps, including the detection and resolution of vulnerabilities, as well as the ongoing monitoring and mitigation of security threats within contemporary software
development pipelines.
The start of the journey includes a first exploration of the Software Development Lifecycle (SDLC) and a comprehensive analysis of the fundamental concepts outlined in the Agile Manifesto, which serve as the foundation for contemporary software development practices. This paper delves deeper into the examination of Continuous Integration and Continuous Delivery (CI/CD) processes, as well as the emergence of DevOps as a disruptive influence inside the industry.
This paper focuses on the Application Security Pipeline for Continuous Integration/Continuous Deployment (CI/CD), examining the intersection of Information Security and Application Security. This statement highlights the significant importance of security in the context of DevOps processes, as well as the difficulties that businesses have while implementing DevSecOps concepts. Also, it provides a thorough examination of vulnerabilities, specifically emphasizing application vulnerabilities, Docker image vulnerabilities, and vulnerabilities inside the CI/CD pipeline, and examines different ways for detecting vulnerabilities across the Software Development Life Cycle (SDLC). These approaches include Static Code Analysis, Dynamic Code Analysis, Software Composition Analysis, and Container Security Analysis.
The primary contribution of this study is to the proposal and assessment of a Continuous Vulnerability Management paradigm within the context of DevSecOps. The document delineates the practices of Continuous Vulnerability Evaluation, Treatment, and Reporting, underscoring the significance of adopting a proactive and iterative methodology towards vulnerability management.
In order to authenticate the suggested framework, a practical case study is shown utilizing the OWASP WebGoat application. This study does a comparative examination of several security technologies utilized in a DevSecOps pipeline. The tools examined include SAST with SNYK, SAST with SonarQube, Container Security with Trivy and Grype, as well as DAST with OWASP-Zap and Arachni. The objective is to evaluate the efficiency of these tools and get valuable insights.
The objective of this thesis is to establish a connection between software development and cybersecurity, providing useful insights and practical advice for businesses seeking to enhance their security measures in the ever-changing realm of contemporary software development.