My notes from the DevOps Handbook

by Gene Kim, Jez Humble, Patrick Debois, John Willis

65. Ensure security of the application

Development testing focuses on the correctness of functionality by looking at positive logic flows. This type of testing is often referred to as the happy path.

Effective QA, Infosec, and Fraud practitioners will otter focus on the sad paths, which happen when things go wrong, especially in relation to security related error conditions.

Instead of performing these tests manually, we would ideally generate them as part of our automated unit or functional tests so that they can be run continuously in our deployment pipeline. As part of our testing, we will want to include the following:

• Static analysis: This is testing that we perform in a non-runtime environment, ideally in the deployment pipeline. Typically, a static analysis tool will inspect program code for all possible run-time behaviors and seek out coding flaws, back doors, and potentially malicious code
• Dynamic analysis: while a program is in operation. Dynamic tests monitor items such as system memory, functional behavior, response time, and overall performance of the system.
• Dependency scanning: inventorying all our dependencies for binaries and executables, and ensuring that these dependencies, which we often don't have control over, are free of vulnerabilities or malicious binaries.
• Source code integrity and code signing: All developers should have their own PGP key, perhaps created and managed in a system such as keybase.io. All commits should be signed, all packages created by the CI process should be signed

Ensure security of our software supply chain

When we use components or libraries in our software, we not only inherit their functionality, but also any security vulnerabilities they contain.

When selecting software, we detect when our software projects are relying on components or libraries that have known vulnerabilities, and help developers choose the components they use deliberately and with due care,

Ensure security of the environment

we should do whatever is required to help ensure that environments are in a hardened, risk reduced state. Put in monitoring ensure that all production instances match these known good states.

We do this by generating automated tests to ensure that all appropriate settings have been correctly applied for configuration hardening, database security settings, key lengths.