DevSecOps Tools

Cost to Fix a Vulnerability:
  Development:     $100    ← SAST catches it here (CHEAPEST)
  QA/Testing:      $500    ← IAST catches it here
  Staging:         $1,000  ← DAST catches it here
  Production:      $10,000 ← RASP or incident response
  Post-Breach:     $100K+  ← Breach notification + remediation

The earlier in the pipeline a vulnerability is found, the cheaper it is to fix.
Shift-left is not just a security principle — it is an economic imperative.

# Semgrep custom rule: Detect hardcoded AWS keys
rules:
  - id: aws-access-key-detected
    patterns:
      - pattern-regex: AKIA[0-9A-Z]{16}
    message: "AWS Access Key ID detected — hardcoded secrets are a breach risk"
    severity: ERROR
    languages: [python, javascript, go, java, ruby]

# Semgrep custom rule: Detect raw SQL queries
rules:
  - id: sql-injection-raw-query
    patterns:
      - pattern: |
          cursor.execute("SELECT * FROM $TABLE WHERE $COL = " + $VAR)
    message: "SQL injection risk — use parameterised queries instead"
    severity: ERROR
    languages: [python]

name: SAST Scan
on: [push, pull_request]
jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: semgrep/semgrep-action@v1
        with:
          config: p/default  # Semgrep registry rules
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

DAST Finding Categories (OWASP ZAP):
  └─ High Risk:
    └─ SQL Injection: DB error in response, time-based blind confirmed
    └─ XSS (Reflected/Stored): Script execution in browser
    └─ Remote Code Injection: System command execution
    └─ Path Traversal: File read outside web root
  └─ Medium Risk:
    └─ CSRF: No anti-CSRF token on state-changing requests
    └─ Missing security headers: CSP, HSTS, X-Frame-Options
    └─ Information disclosure: Stack traces, directory listing
    └─ Weak authentication: No account lockout, weak password policy
  └─ Low Risk:
    └─ Server header disclosure: Apache/2.4.49 (Ubuntu)
    └─ Cookie without Secure/HttpOnly flags
    └─ Auto-complete enabled on password fields

SCA Finding (Snyk):
  Package: lodash@4.17.20
  Vulnerability: Prototype Pollution (CVE-2020-8203)
  Severity: HIGH (CVSS 7.4)
  Fixed in: lodash@4.17.21
  Path: my-app > express > body-parser > lodash (transitive dependency)
  Remediation: Update lodash to 4.17.21 or upgrade body-parser

SCA Finding (Trivy):
  Package: node:18-alpine
  Vulnerability: CVE-2023-31484 (HTTP Request Smuggling)
  Severity: CRITICAL
  Fixed in: node:18.16.1-alpine
  Remediation: Rebuild container with updated base image

Secret Types Detected:
  └─ AWS Access Key IDs (AKIA*)
  └─ AWS Secret Access Keys
  └─ GitHub Personal Access Tokens (ghp_*)
  └─ GitHub OAuth Access Tokens (gho_*)
  └─ GitLab Personal Access Tokens (glpat-*)
  └─ Slack API Tokens (xoxb-*, xoxp-*)
  └─ Google API Keys
  └─ Azure Storage Account Keys
  └─ SSH Private Keys
  └─ JWT Tokens (if high-entropy)
  └─ Generic High-Entropy Strings (base64, hex)

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "metadata": {
    "component": {
      "name": "my-app",
      "version": "2.3.1",
      "type": "application"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21",
      "licenses": [{"license": {"id": "MIT"}}]
    }
  ]
}

SBOM Applications:
  └─ Vulnerability management: Scan SBOM against CVE database (Grype, Trivy)
  └─ License compliance: Verify all components use approved licenses
  └─ Supply chain attestation: Prove what software is in your product
  └─ Incident response: When Log4Shell was announced, did you have log4j?
  └─ Regulatory compliance: US Executive Order 14028, EU Cyber Resilience Act

# Complete DevSecOps pipeline (GitHub Actions)
name: DevSecOps Pipeline
on: [push]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # SAST — source code analysis
      - name: SAST Scan
        run: semgrep scan --config=auto --json -o semgrep-report.json .

      # SCA — dependency analysis
      - name: SCA Scan
        run: snyk test --all-projects --json > snyk-report.json

      # Secret scanning
      - name: Secret Scan
        run: |
          pip install truffleHog
          trufflehog --json . > secrets-report.json

      # Container scanning (if building image)
      - name: Container Scan
        run: trivy image --severity CRITICAL,HIGH --exit-code 1 my-app:latest

      # Generate SBOM
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          path: .
          format: spdx-json

      # Block PRs with critical findings
      - name: Block Critical Findings
        run: |
          if jq -e '.results[] | select(.severity == "CRITICAL")' semgrep-report.json > /dev/null; then
            echo "❌ CRITICAL SAST findings detected — blocking PR"
            exit 1
          fi

Gate Decisions by Severity:
  └─ CRITICAL: Block the pipeline (must fix)
  └─ HIGH: Block the pipeline (require fix or documented exception)
  └─ MEDIUM: Warn in PR, allow merge with approval
  └─ LOW: Log for tracking, do not block

Gate Timing:
  └─ Commit stage: SAST + SCA + Secret scan (fast, < 5 minutes)
  └─ Build stage: Container scan + SBOM generation
  └─ Test stage: DAST (slower, runs on deployable artifact)
  └─ Deploy stage: RASP activated in production

Exceptions:
  └─ False positives: Document and suppress with justification
  └─ Accepted risk: Formal waiver with expiry date
  └─ Time-boxed fix: Jira ticket created, auto-recheck in 30 days