DevSecOps. PT Application Inspector in software development: release blocking

Hello everyone! My name is Timur Gilmullin, I work in the technology and development process department at Positive Technologies. Informally, we are called the DevOps department, and our guys are engaged in the automation of various processes and help programmers and testers work with product pipelines.

, PT Application Inspector . - CI/CD-, CI-. PT Application Inspector — .

:

• DevSecOps- , PT Application Inspector CI- ;

  
  
  
  
  

• Security Gates, - GitLab;

  
  
  
  
  

• , .

  
  
  
  
  

DevSecOps Positive Technologies

DevSecOps CI/CD- . , PT Application Inspector .

CI/CD- . (Developing), git-, GitLab CI (Unit-Testing + Building). (Deploying) (Functional Testing). Artifactory (Promoting), GUS FLUS- (Publishing GUS/FLUS). (Installing/Updating). (Collecting telemetry), (Monitoring) (User's feedback). .

Security- , , , . . , . , PT Application Inspector, — , . CI/CD- , MaxPatrol.SIEM - PT Application Firewall.

, DevSecOps, , , . - « » — . , , .

PT Application Inspector Positive Technologies

, . , , DevOps-, . . DevSecOps Positive Technologies.

DevSecOps-, CI- PT Application Inspector , , . , , ; -, DevSecOps- PT Application Inspector .

:

1. SAST/DAST/IAST- CI- , ( shift-left).

   
   
   
   
   

2. — . .

   
   
   
   
   

3. PT Application Inspector « », «» — CI- — , .

   
   
   
   
   

4. DevSecOps . PT Application Inspector DevSecOps, CI/CD-. Positive Technologies , , .

   
   
   
   
   

PT Application Inspector CI-

:

• DevOps.BuildAgent —

  
  
  
  
  

• Docker.Linux.AISA.Latest/TAG — - AISA,

  
  
  
  
  

• AI.Agent —

  
  
  
  
  

• AI.Server — PT Application Inspector

  
  
  
  
  

• DevOps.GitLab —

  
  
  
  
  

• DevOps.GitLab-CI — CI-

  
  
  
  
  

• DevOps.Artifactory —

  
  
  
  
  

• Docker.Registry — -

  
  
  
  
  

• Docker.Linux.AISA — AISA ( - )

  
  
  
  
  

• AI.Shell Agent — AISA, -, API PT Application Inspector

  
  
  
  
  

• BuildAgent.Console —

  
  
  
  
  

• WorkingDirectory — , ,

  
  
  
  
  

, . PT Application Inspector . GitLab CI. GitLab , AISA .

AISA — Application Inspector Shell Agent. API PT Application Inspector. AISA -, «» .

- AISA CI-, CI- DevOps-. docker registry Artifactory. - AISA.

CI-. :

1. :

   
   
   
   
   

   ●      PT Application Inspector;

   
   
   
   
   

   ●      .

   
   
   
   
   

2. :

   
   
   
   
   

   ●      CI- AISA ( -).

   
   
   
   
   

3. :

   
   
   
   
   

   ●      ;

   
   
   
   
   

   ●      AISA.

   
   
   
   
   

4. CI-:

   
   
   
   
   

   ●      GitLab CI;

   
   
   
   
   

   ●      TeamCity;

   
   
   
   
   

   ●      ( CLI AISA).

   
   
   
   
   

PT Application Inspector , - CI- .

PT Application Inspector

— , . , , () . , , . AISA. , , .

:

1. GitLab.

   
   
   
   
   

2. .

   
   
   
   
   

3. build-on-server, . — CI-. build-on-server , , CI- CI-.

   
   
   
   
   

4. AISA. .

   
   
   
   
   

5. .

   
   
   
   
   

6. , .

   
   
   
   
   

7. . , .

   
   
   
   
   

8. .

   
   
   
   
   

9. AISA- , .

   
   
   
   
   

10. Security Gates. Code Quality Status — 0, , 1, .

    
    
    
    
    

11. Code Quality Status 0, , . 1 , — .

    
    
    
    
    

12. Artifactory. .

    
    
    
    
    

13. Security Gates GitLab CI - GitLab. , .

    
    
    
    
    

:

1. , . , AISA GitLab CI.

   
   
   
   
   

2. , — PT Application Inspector , , . GitLab CI, downstream pipelines, . , , .

   
   
   
   
   

3. , , - GitLab, , , - , Security Gates ( Code Quality Gates SonarQube).

   
   
   
   
   

4. git. , -, - .

   
   
   
   
   

Security Gates:

, , Security Gates - GitLab.

Security Gates — , CI-, : - .

«» Artifactory — -BANNED , , Security Gates.

yaml-, :

• threats mapping — GitLab ( ) PT Application Inspector ( ). , . , , GitLab Potential, Low, Medium Info.

  
  
  
  
  

• security gates — . , - . , . , .

  
  
  
  
  

Security Gates . , . .

SonarQube GitLab — codequality. , -, , . , «» , legacy-, . , .

, , , -. , CI- AISA GitLab CI.

Security Gates:

, Security Gates, Code Quality Status 0 (Passed). - , GitLab ( ) . , , HTML- GitLab CI TeamCity, .

, Security Gates, — Code Quality Status 1 (Failed) - Draft .

, , , Security Gates , .

-: .

TeamCity -«», AISA-. HTML- TeamCity, (Tab reports), .

, TeamCity - GitLab.

, Security Gates — Code Quality Status — .

Security Gates:

, PT Application Inspector . , . , . GitLab CI.

CI- , . - , . .

— . , Security Gates -, .

, .gitlab-ci.yml .

Security Gates: Information mode

GitLab CI, (AI Information Mode).

, :

• - (Unit tests);

  
  
  
  
  

• (Build);

  
  
  
  
  

• (Upload to registry).

  
  
  
  
  

GitLab CI gitlab-ci.yml include. :

• (Start AI Scan);

  
  
  
  
  

• AISA (AI-Scanning);

  
  
  
  
  

• — (Send info);

  
  
  
  
  

• — AISA (AI Scan Report);

  
  
  
  
  

• Security Gates, — Code Quality Status (0, Passed / 1, Failed) — ;

  
  
  
  
  

• (Send emails).

  
  
  
  
  

, -.

Security Gates: Lock mode

(AI Lock Mode) — . , (include) , , .

, : (running). , Security Gates - GitLab . , .

Security Gates: Strictest mode

, , (AI Strictest Mode) — . , , , (Approve build). , , Security Gates, , -. - (Draft).

, .

git Security Gates

git-flow :

• master — ;

  
  
  
  
  

• develop — -;

  
  
  
  
  

• feature — ;

  
  
  
  
  

• release — , .

  
  
  
  
  

- , . , - .

:

• feature- (Information mode). - feature- develop . PT Application Inspector.

  
  
  
  
  

• develop- (Strictest mode), Security Gates. . , - , .

  
  
  
  
  

• release- (Lock mode) - master, develop.

  
  
  
  
  

• master- (Information mode), , , , .

  
  
  
  
  

: Security Gates -

2021 . DevSecOps-. , Security Gates , , - Application Inspector .

Open Source dohq-ai-best-practices

GitLab CI TeamCity, PT Application Inspector Open Source dohq-ai-best-practices MIT-. :

• PT Application Inspector CI.

  
  
  
  
  

• PT Application Inspector.

  
  
  
  
  

• Dockerfile AISA- Windows Linux.

  
  
  
  
  

• GitLab CI TeamCity - .

  
  
  
  
  

DevOps

CI :

• « : Continuous Integration» (2016)

  
  
  
  
  

• « : Positive Technologies DevOps» (2017)

  
  
  
  
  

• « -» (2018)

  
  
  
  
  

• « : » (2019)

  
  
  
  
  

• « : DevOps» (2020)

  
  
  
  
  

• «DevSecOps: PT Application Inspector » (2020)

  
  
  
  
  

• « DevOps Positive Technologies» (2021)

  
  
  
  
  

, . . :)

: — Positive Technologies. PT Application Inspector DevOps-, Open Source.

: — CI- . PT Application Inspector CI- Open Source.

DevSecOps . : , , , PT Application Inspector, , DevOps Positive Technologies PT Application Inspector , :)