Application Security Testing (SAST, DAST)
Summary
Just like we have Auto Code Quality we should add Auto SAST and Auto DAST to Auto DevOps. Both use open source scanners with signatures to find vulnerabilities. Static Application Security Testing (SAST) finds them in the code. Dynamic Application Security Testing (DAST) finds it in a running review app. DAST can also be run against external targets by security researchers who self-host GitLab.
As a next iteration we can assess the signal to noise (false positives) of the different signatures based on if people create an issue or dismiss the signal. We can also add a GitLab Recon functionality (https://gitlab.com/gitlab-org/gitlab-ce/issues/40119) to find new hosts to scan based on the top-level domain name. This is based on DNSDB data of queries people made so it works without needed access to DNS zone files.
Concepts
- Security development lifecycle https://www.microsoft.com/en-us/sdl/default.aspx
- Fuzz testing https://en.wikipedia.org/wiki/Fuzzing
- DAST Only DAST can be used against external targets
- SAST
- UVM Unified Vulnerability Management => testing version instead of vulnerability
- PEN Penetration testing, similar to DAST
- Network security => preventing access, outdated
- GitLab CI functions like a C&C server for the tests.
Timeline
10.3 -
-
Auto SAST: https://gitlab.com/gitlab-org/gitlab-ee/issues/3723 -
Show SAST results in MR widget: https://gitlab.com/gitlab-org/gitlab-ee/issues/3775 -
Sort security vulnerabilities by priority in MR widget: https://gitlab.com/gitlab-org/gitlab-ee/issues/3961 -
Add SAST in Auto DevOps documentation: https://gitlab.com/gitlab-org/gitlab-ee/issues/4125
10.4 -
-
Security Scanning in Registry: https://gitlab.com/gitlab-org/gitlab-ee/issues/3724 -
Show results from docker image scan in the merge request widget: https://gitlab.com/gitlab-org/gitlab-ee/issues/4249 -
Dynamic Application Security Testing (DAST): https://gitlab.com/gitlab-org/gitlab-ee/issues/3956 -
Show DAST results in the MR widget: https://gitlab.com/gitlab-org/gitlab-ee/issues/4348
10.5 -
-
Improved visualization of SAST results in MR widget: https://gitlab.com/gitlab-org/gitlab-ee/issues/3995 -
Add Gemnasium dependency check to SAST: https://gitlab.com/gitlab-org/gitlab-ee/issues/4682
10.6 -
-
Support SAST for Java applications (Maven): https://gitlab.com/gitlab-org/gitlab-ee/issues/4123 -
Add authentication options to DAST checks: https://gitlab.com/gitlab-org/gitlab-ee/issues/4504 Stretch
10.7 -
-
SAST for C/C++: https://gitlab.com/gitlab-org/gitlab-ee/issues/4124 -
Group security issues panels in the MR widget: https://gitlab.com/gitlab-org/gitlab-ee/issues/4310 -
Introduce explanation question mark icon tooltips MR widget for different tests: https://gitlab.com/gitlab-org/gitlab-ee/issues/4464 Stretch
Related
- Common metric format => Shared between code quality, SAST, DAST, load testic
- EEP Enterprise Dashboard
- Signal to noise ratio
- Use against external targets
- Add DNS DB
- Constant Deployment https://gitlab.com/gitlab-org/gitlab-ee/issues/3363
- OpenVAS https://gitlab.com/gitlab-com/infrastructure/issues/2483