/catalog/296695a3fdd74f71b4ced1996c9b6856//Document/520680288002117.html/Document/520679709044805.html/Document/520421404913733.html/Document/520420916084805.html/Document/519695556915269.html/Document/519695178637381.html/Document/519286084939845.html/Document/519285550596165.html/Document/517527679774789.html/Document/517527163703365.html/Document/512185975087173.html/Document/511946871631941.html/Document/511946429853765.html/Document/510490688409669.html/Document/510490145665093.html/Document/509474966245445.html/Document/509474292002885.html/Document/508381305012293.html/Document/508380165513285.html/Document/507942179053637.html/Document/507941613613125.html/Document/507336815288389.html/Document/507336323162181.html/Document/506969107042373.html/Document/506968450326597.html/Document/505888177782853.html/Document/505887157772357.html/Document/505549163270213.html/Document/505548496027717.html/Document/505143668654149.html/Document/505143105032261.html/Document/504503398395973.html/Document/504502746468421.html/Document/503017040437317.html/Document/503016609853509.html/Document/502718247415877.html/Document/502717705343045.html/Document/502361750245445.html/Document/502361307697221.html/Document/501990556381253.html/Document/501989827113029.html/Document/500880675987525.html/Document/500880224911429.html/Document/500250144956485.html/Document/500232490541125.html/Document/499908522852421.html/Document/499907986919493.html/Document/498447282262085.html/Document/498446788378693.html/Document/498103952822341.html/Document/498103476068421.html/Document/497705815789637.html/Document/497703055208517.html/Document/497352259182661.html/Document/497351210856517.html/Document/496977382301765.html/Document/496976846573637.html/Document/495934617931845.html/Document/495933266260037.html/Document/495577945600069.html/Document/495576688218181.html/Document/494873100378181.html/Document/494872714567749.html/Document/494515031642181.html/Document/494514507194437.html/Document/492829277941829.html/Document/492826934538309.html/Document/492478892306501.html/Document/492478432673861.html/Document/492048771612741.html/Document/492048321876037.html/Document/491018538238021.html/Document/491017994391621.html/Document/490617591144517.html/Document/490616589226053.html/Document/490277546360901.html/Document/490277081866309.html/Document/488480491106373.html/Document/488479777673285.html/Document/488131539537989.html/Document/488129496956997.html/Document/487787449102405.html/Document/487786620837957.html/Document/487425698246725.html/Document/487425161941061.html/Document/487077007417413.html/Document/487076470157381.html/Document/486012783796293.html/Document/486011843792965.html/Document/485654058504261.html/Document/485653628149829.html/Document/485285488848965.html/Document/485005121204293.html/Document/485004810907717.html/Document/483634668224581.html/Document/483162688110661.html/Document/482456439619653.html/Document/480691329347653.html/Document/479981549019205.html/Document/479640516874309.html/Document/478581868011589.html/Document/478211995488325.html/Document/477860005101637.html/Document/477516631253061.html/Document/476091023597637.html/Document/475748190408773.html/Document/475747825885253.html/Document/475390229778501.html/Document/475389762682949.html/Document/475021811523653.html/Document/475021482278981.html/Document/474681074966597.html/Document/474680715309125.html/Document/473641910472773.html/Document/473641599152197.html/Document/472917246013509.html/Document/472916949708869.html/Document/472553316364357.html/Document/472553009672261.html/Document/472222551654469.html/Document/472222166081605.html/Document/470772911669317.html/Document/470772523974725.html/Document/470491812298821.html/Document/470491020734533.html/Document/470144418017349.html/Document/470144062480453.html/Document/469355727437893.html/Document/469355344896069.html/Document/469002772238405.html/Document/469002372866117.html/Document/465854760509509.html/Document/465854252036165.html/Document/465481503801413.html/Document/465481068789829.html/Document/465193214992453.html/Document/465192312610885.html/Document/464860703494213.html/Document/464860235079749.html/Document/463357444149317.html/Document/463351258955845.html/Document/462989079121989.html/Document/462988335923269.html/Document/462660239003717.html/Document/462658920042565.html/Document/461304163098693.html/Document/461301616328773.html/Document/460881708830789.html/Document/460876803891269.html/Document/460520743743557.html/Document/460513554071621.html/Document/460169107955781.html/Document/460168465489989.html/Document/459825920966725.html/Document/459825340420165.html/Document/458389364535365.html/Document/458388990779461.html/Document/458052748820549.html/Document/458051490840645.html/Document/457785747443781.html/Document/457785205239877.html/Document/457346283610181.html/Document/457345117622341.html/Document/456266454548549.html/Document/456265627877445.html/Document/455911269912645.html/Document/455557920325701.html/Document/455557492965445.html/Document/455218049572933.html/Document/454857812234309.html/Document/453789017641029.html/Document/453449959817285.html/Document/453079570784325.html/Document/452403319308357.html/Document/451310486503493.html/Document/450994786713669.html/Document/450345001971781.html/Document/449962449588293.html/Document/448929358094405.html/Document/448230949081157.html/Document/447863453311045.html/Document/446102887440453.html/Document/445725270851653.html/Document/445022107115589.html/Document/443641819930693.html/Document/443271687684165.html/Document/443270796382277.html/Document/443270370861125.html/Document/441430268338245.html/Document/441419688190021.html/Document/441419056222277.html/Document/440429294637125.html/Document/438340763410501.html/Document/437986291200069.html/Document/437603819495493.html/Document/436191615103045.html/Document/435855229702213.html/Document/435147718438981.html/Document/434051877818437.html/Document/433366954807365.html/Document/432997464641605.html/Document/432628688769093.html/Document/432266670596165.html/Document/430907430723653.html/Document/428784032424005.html/Document/428385797652549.html/Document/428062862630981.html/Document/427712386293829.html/Document/426283111870533.html/Document/424188637298757.html/Document/423430430916677.html/Document/422738450387013.html/Document/421335462469701.html/Document/420956089200709.html/Document/420244068835397.html/Document/419142595375173.html/Document/418879737671749.html/Document/418156051357765.html/Document/417780141715525.html/Document/416729842651205.html/Document/416373677670469.html/Document/416014651207749.html/Document/414600654966853.html/Document/414232150913093.html/Document/413894034452549.html/Document/411749575036997.html/Document/411444007235653.html/Document/410989555187781.html/Document/410365315555397.html/Document/408937260335173.html/Document/408592682856517.html/Document/408239118336069.html/Document/402940329152581.html/Document/401521045061701.html/Document/401149456379973.html/Document/400819542675525.html/Document/400464907001925.html/Document/399363703992389.html/Document/399019061391429.html/Document/398327264952389.html/Document/397988956139589.html/Document/396547962679365.html/Document/396188926316613.html/Document/395839580831813.html/Document/395509538283589.html/Document/393696815161413.html/Document/393356444545093.html/Document/393008819511365.html/Document/391891180220485.html/Document/391256916983877.html/Document/390918744105029.html/Document/390528820486213.html/Document/389136971677765.html/Document/388763822231621.html/Document/388416565977157.html/Document/388045527777349.html/Document/386637062586437.html/Document/386290355249221.html/Document/386290343432261.html/Document/385922848862277.html/Document/384498574901317.html/Document/384178599956549.html/Document/383813990293573.html/Document/383450832826437.html/Document/383112784425029.html/Document/381983009394757.html/Document/381676021035077.html/Document/381338668412997.html/Document/380973198676037.html/Document/380625301606469.html/Document/376028059926597.html/Document/374587749163077.html/Document/374252417724485.html/Document/373905092177989.html/Document/373540837523525.html/Document/373226847809605.html/Document/311601443917893.html/Document/311285189517381.html/Document/310134890274885.html/Document/309794452426821.html/Document/309507604934725.html/Document/304898482892869.html/Document/304549706600517.html/Document/304188584996933.html/Document/303818784497733.html/Document/302700517105733.html/Document/302416475320389.html/Document/302077848256581.html/Document/301288627347525.html/Document/300279638184005.html/Document/274792263872581.html/Document/273024381308997.html/Document/272683642789957.html/Document/272351623921733.html/Document/271961406242885.html/Document/271560844214341.html/Document/270477420015685.html/Document/269881559916613.html/catalog/c51244b85e704db9a2a34ca396e9fe27//Document/375674108960837.html/Document/340619525128261.html/Document/340263572500549.html/Document/337103780888645.html/Document/336726028042309.html/Document/336395351863365.html/Document/336019384291397.html/Document/334605603291205.html/Document/334264344903749.html/Document/333908786077765.html/Document/333537608929349.html/Document/332422937043013.html/Document/323979240091717.html/Document/323624591507525.html/Document/322518056206405.html/Document/322224629981253.html/Document/321870777405509.html/Document/321154810175557.html/Document/319738524639301.html/Document/319395521761349.html/Document/319038449188933.html/Document/318684198744133.html/Document/317575537291333.html/Document/316584392339525.html/Document/297463116619845.html/Document/296410729726021.html/Document/294281412902981.html/Document/289614801383493.html/Document/289336711553093.html/Document/288989717336133.html/Document/267736666357829.html

DevSecOps流程解析——安全测试未来发展大趋势

DevSecOps最佳实践的流程图

上面这个图就是本文重点要跟大家分享的DevSecOps最佳实践的流程图,也就是如何把应用安全很好地嵌入到我们的整个流程里面去。


首先,在开发的这个闭环中,开发人员在IDE开发代码的同时,我们就可以将应用安全测试嵌到开发工具里。具体例子,比如说我们在eclipse上,通过安全工具的插件,把安全审计的功能嵌入进去。


IDE里就多了一些菜单和选项,能够让我们在开发的时候就可以做相应的安全的检查。这样的检查是自查,这时候开发人员并没有提交代码。


当然这里也涉及到企业文化,比如开发人员说“我没空去做检查,我的职责是实现软件功能,我可能没有时间和精力去做安全测试”。这时候应该怎么办呢?我们还有一些插件是可以实时检测的,就是每写一行,就同步告诉你,你写的这一行有没有安全问题。


不需要开发人员再花时间去做安全测试,而是实时地去检查代码。我们可以称之为“安全小助手”,帮助我们做代码的检查。当然最好还是做全面的检查,去做安全测试,当然要花一些时间,比如可能我们需要在下班的时候开启一个扫描,第二天上班的时候再去看扫描结果。

代码提交到仓库之后,这个时候,我们需要通过Jenkins去做CI/CD了,在这个时候去做安全测试也是非常好的。因为这个时候我们已经形成一个版本了,模块也已经完成了,可以把完整的项目代码拉出来,做一个完整的、全面的安全扫描测试。


这一部分在我们的用户实践里面是最广泛的,比开发人员自查自检要广泛。因为很难保障开发人员自己去检查自己的问题,因为没有一个机制强迫开发人员去做这个事情。但是在CI/CD阶段,流程里肯定是要加这个环节,这是必须要做的一件事情。


测试完成之后,我们的测试结果要自动传到可视化的漏洞安全管理平台上去,我们需要将测试结果可视化,而且需要很方便就可以看到。而且也可以通过专门的相关的人员,如审计员,去把这些测试结果里面确定的bug,提交到Jira这类缺陷管理平台里面,做跟踪和管理。直到开发人员把这些问题修复掉,bug关掉了就算结束了。


我们在下一轮再去做扫描,验证是不是已经被修复了,再做一次测试。而且这种上线之前的自动化测试不仅仅是针对源代码的安全测试,还可以模拟黑客,对web应用做漏洞扫描。


这一点也是目前比较新的理念,大家对黑盒测试的理解往往是上线之前最后阶段才测,但是我们建议在CI/CD阶段应用发布的时候就可以去做一次模拟黑客的web漏洞扫描了,这是可以做到的。我们后面也会讲到,黑盒测试是可以再左移到CI/CD阶段的。

然后在问题修复完成之后,才能保证上线。上线之后,在生产环境中,我们的安全防护也是必不可少。当然,我们现在更多的是部署WAF、web应用防火墙这种边界的防御。但是未来的大方向我觉得还是RAST技术,应用的自我防御。因为WAF产品毕竟是网络边界产品,有很多威胁防御不了、发现不了。从应用本身内部去发现和监控问题,这一定是未来一个大的方向和趋势。