spinny:~/writing $ less devsecops-shift-left-security-guide.md
12Vrazlyvist, vyyavlena pid chas napysannya kodu, koshtuye rozrobnyku khvylyn na vypravlennya. Ta sama vrazlyvist, vylovlena v produktsiyi, koshtuye tsilyy sprint. A yakshcho yiyi pershoyu znakhodyt zlovmysnyk, vona koshtuye milyony. Tse holovnyy argument na koryst **shift-left security** - peresuvannya perevirok bezpeky yak nayrannishe v zhyttyevomu tsykli rozrobky.34DevSecOps bere tsyu ideyu i peretvoryuye yiyi v praktyku: bezpeka - tse ne okrema faza naprykintsi, a bezperervnyy protses, vpletennyy u kozhnyy etap rozrobky - vid pershoho ryadka kodu do rozghortannya v produktsiyi.56## Vartist piznyoyi bezpeky78Zvit IBM Cost of a Data Breach poslidovno pokazuye, shcho vartist vypravlennya problem bezpeky zrostaye eksponentsialno, chym piznishe vony vyyavlyayutsya:910| Etap | Vartist vypravlennya | Chas na vypravlennya |11|------|---------------------|---------------------|12| **IDE / Lokalna rozrobka** | Khvylyny | Sekundy do khvylyn |13| **Code Review / PR** | Hodyny | Khvylyny do hodyn |14| **Pipeline CI/CD** | Dni | Hodyny do dniv |15| **Staging / QA** | Tyzhni | Dni |16| **Produktsiya** | Misyatsi | Tyzhni do misyatsiv |17| **Pislya vtyku dannykh** | Milyony ($) | Misyatsi do rokiv |1819Vysnovok ochevydnyy: kozhnyy etap, na yakyy vy peresuvayete bezpeku rannishe, ekonomyt poryadok velychyny u vytratakh i chasi.2021## Pipeline DevSecOps2223Zrilyy pipeline DevSecOps intehruye perevirky bezpeky na kozhnomu etapi:2425```mermaid26graph LR27 IDE[IDE / Editor] --> PC[Pre-commit Hooks]28 PC --> PR[Pull Request]29 PR --> CI[CI Pipeline]30 CI --> Build[Build / Package]31 Build --> Deploy[Deploy]32 Deploy --> Runtime[Runtime / Production]3334 IDE -.- S1[SAST\nSecret Detection\nLinting]35 PC -.- S2[Secrets Scan\nFormat Check]36 PR -.- S3[Code Review\nDependency Audit]37 CI -.- S4[SAST\nSCA\nContainer Scan\nSBOM]38 Build -.- S5[Image Signing\nArtifact Verification]39 Deploy -.- S6[Policy Enforcement\nAdmission Control]40 Runtime -.- S7[DAST\nWAF\nMonitoring]41```4243Rozberemmo kozhnyy etap z konkretnymy instrumentamy ta konfiguratsiyeyu.4445## Etap 1: Bezpeka v IDE4647Nayshvydshyy tsykl zvorotnoho zvyazku. Lovit vrazlyvosti shche do toho, yak vy zberezhetye fayl.4849### Rekomendovani instrumenty5051- **Semgrep**: lehkyy statychnyy analizator z pravylamy spilnoty dlya vrazlyvostey OWASP52- **Snyk IDE Extension**: skanuvannya vrazlyvostey zalezhnostey u realnomu chasi53- **GitLens + GitLeaks**: vyyavlennya sekretiv u vashomu redaktori54- **ESLint Security Plugins**: `eslint-plugin-security` dlya Node.js, `eslint-plugin-no-unsanitized` dlya DOM XSS5556### Pryklad: Konfiguratsiya ESLint Security5758```json59{60 "extends": ["eslint:recommended"],61 "plugins": ["security", "no-unsanitized"],62 "rules": {63 "security/detect-object-injection": "warn",64 "security/detect-non-literal-regexp": "warn",65 "security/detect-unsafe-regex": "error",66 "security/detect-buffer-noassert": "error",67 "security/detect-eval-with-expression": "error",68 "security/detect-no-csrf-before-method-override": "error",69 "security/detect-possible-timing-attacks": "warn",70 "no-unsanitized/method": "error",71 "no-unsanitized/property": "error"72 }73}74```7576## Etap 2: Pre-commit Hooks7778Druha liniya oborony. Zapuskayetsya avtomatychno pered kozhnym commitom, blokuyuchy nebezpechnyy kod vid potrapiannya do repozytoriyu.7980### Gitleaks: Lovit sekrety do togo, yak vony potraplyat u Git8182Nayposhyrenisha pomylka bezpeky v kodovykh bazakh - tse commit sekretiv - API-klyuchiv, paroliv baz danykh, tokeniv. Yak tilky sekret potraplyaye v istoriyu git, yoho nadzvychayno vazhko povnistyu vydalyty (navit pry force push forky ta keshi mozhut yoho zberehty).8384```yaml85# .pre-commit-config.yaml86repos:87 - repo: https://github.com/gitleaks/gitleaks88 rev: v8.21.089 hooks:90 - id: gitleaks9192 - repo: https://github.com/semgrep/semgrep93 rev: v1.90.094 hooks:95 - id: semgrep96 args: ['--config', 'auto']97```9899Vstanovlennya ta aktyvatsiya:100101```bash102pip install pre-commit103pre-commit install104```105106Teper kozhnyy `git commit` avtomatychno skanuye na vytoky sekretiv ta poshyreni vrazlyvosti. Yakshcho shchos vyyavleno, commit blokuyetsya.107108### Korystuvatsski pravyla Gitleaks109110Vy mozhete dodaty vlasni shablony dlya sekretiv vashoyi orhanizatsiyi:111112```toml113# .gitleaks.toml114title = "Custom Gitleaks Config"115116[[rules]]117id = "internal-api-key"118description = "Internal API key detected"119regex = '''INTERNAL_KEY_[A-Za-z0-9]{32}'''120tags = ["key", "internal"]121```122123## Etap 3: Bezpeka pipeline CI/CD124125Tut vidbuvayetsya osnovna robota. Vash CI pipeline povynen zapuskaty kilka skanovan bezpeky pry kozhnomu pull requesti.126127### SAST (Static Application Security Testing)128129Instrumenty SAST analizuyut vykhidnyy kod bez yoho vykonannya, shukayuchy shablony, shcho vkazuyut na vrazlyvosti.130131```yaml132# .github/workflows/security.yml133name: Security Scan134on:135 pull_request:136 branches: [main]137138jobs:139 sast:140 name: Static Analysis141 runs-on: ubuntu-latest142 steps:143 - uses: actions/checkout@v4144145 - name: Run Semgrep146 uses: semgrep/semgrep-action@v1147 with:148 config: >-149 p/owasp-top-ten150 p/typescript151 p/nodejs152 p/react153 generateSarif: true154155 - name: Upload SARIF156 uses: github/codeql-action/upload-sarif@v3157 with:158 sarif_file: semgrep.sarif159```160161Nabir pravyl `p/owasp-top-ten` vid Semgrep lovyt nayposhyrenishi vrazlyvosti: SQL injection, XSS, SSRF, path traversal, insecure deserialization ta inshi.162163### SCA (Software Composition Analysis)164165SCA skanuye vashi zalezhnosti na vidomi vrazlyvosti. Tse krytychno vazhlyvo - ponad 80% kodu suchasnykh dodatkiv pokhodyat iz zalezhnostey open-source.166167```yaml168 dependency-scan:169 name: Dependency Audit170 runs-on: ubuntu-latest171 steps:172 - uses: actions/checkout@v4173174 - name: Run Snyk175 uses: snyk/actions/node@master176 env:177 SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}178 with:179 args: --severity-threshold=high180181 - name: npm audit182 run: npm audit --audit-level=high183```184185### Bezpeka konteyneriv z Trivy186187Yakshcho vy stvoryuyete obrazy Docker, yikh skanuvannya na vrazlyvosti ye neobkhidnym. **Trivy** - naypopulyarnishyy open-source skaner konteyneriv.188189```yaml190 container-scan:191 name: Container Security192 runs-on: ubuntu-latest193 steps:194 - uses: actions/checkout@v4195196 - name: Build image197 run: docker build -t my-app:${{ github.sha }} .198199 - name: Run Trivy200 uses: aquasecurity/trivy-action@master201 with:202 image-ref: my-app:${{ github.sha }}203 format: 'sarif'204 output: 'trivy-results.sarif'205 severity: 'CRITICAL,HIGH'206 exit-code: '1'207208 - name: Upload Trivy SARIF209 uses: github/codeql-action/upload-sarif@v3210 with:211 sarif_file: trivy-results.sarif212```213214### Heneratsiya SBOM215216**Software Bill of Materials (SBOM)** - tse povnyy inventar kozhnoho komponenta u vashomu dodatku. Dedali chastishe vymahayetsya ramkamy vidpovidnosti ta derzhavnymy rehulyatsiyamy (Vykonavchyy ukaz prezydenta SSHA z kiberbezpeky prypysuye SBOM dlya federalnoho prohramnoho zabezpechennya).217218```yaml219 sbom:220 name: Generate SBOM221 runs-on: ubuntu-latest222 steps:223 - uses: actions/checkout@v4224225 - name: Generate SBOM with Syft226 uses: anchore/sbom-action@v0227 with:228 format: spdx-json229 output-file: sbom.spdx.json230231 - name: Upload SBOM232 uses: actions/upload-artifact@v4233 with:234 name: sbom235 path: sbom.spdx.json236```237238## Etap 4: Bezpechni obrazy Docker239240Produktsiynyy obraz Docker povynen dotrymuvatysya pryntsypu naymenshykh pryvileyi. Osi yak vyhlyadaye zmitsnennyy Dockerfile:241242```dockerfile243# Build stage244FROM node:22-alpine AS builder245WORKDIR /app246COPY package.json package-lock.json ./247RUN npm ci248COPY . .249RUN npm run build250251# Production stage252FROM node:22-alpine AS runner253WORKDIR /app254255# Install dumb-init before dropping root256RUN apk add --no-cache dumb-init257258# Don't run as root259RUN addgroup -S app && adduser -S app -G app260261# Copy only what's needed262COPY --from=builder --chown=app:app /app/dist ./dist263COPY --from=builder --chown=app:app /app/node_modules ./node_modules264COPY --from=builder --chown=app:app /app/package.json ./265266# Drop to non-root user267USER app268ENTRYPOINT ["dumb-init", "--"]269270# Health check271HEALTHCHECK --interval=30s --timeout=3s --retries=3 \272 CMD wget -qO- http://localhost:3000/health || exit 1273274EXPOSE 3000275CMD ["node", "dist/server.js"]276```277278Klyuchovi praktyky:2792801. **Vykorystovuyte multi-stage builds**: etap builder maye zalezhnosti rozrobky; etap runner maye tilky produktsiynyy kod2812. **Ne zapuskuyte vid imeni root**: stvorit ne-root korystuvacha ta pereyddit na nyoho2823. **Vykorystovuyte obrazy Alpine**: mensha poverkhnya ataky (mensha paketiv vstanovleno za zamovchuvannyam)2834. **Fiksuite versiyi obraziv**: `node:22-alpine` zamist `node:latest` dlya zapobihannya atakam na lantsyuh postachannya2845. **Vykorystovuyte `npm ci`**: deterministychne vstanovlennya z lock-faylu, a ne `npm install`285286## Etap 5: Upravlinnya sekretamy287288Zhorstko zakodovani sekrety - prychyna nomer odyn vytokiv danykh u insydentakh, sprychynenykh rozrobnykamy.289290### Choho NE robyty291292```typescript293// NEVER do this294const API_KEY = "sk-1234567890abcdef";295const DB_PASSWORD = "supersecret123";296297const client = new Client({298 connectionString: `postgres://admin:${DB_PASSWORD}@db.example.com/prod`299});300```301302### Shcho robyty zamist tsoho303304```typescript305// Use environment variables306const client = new Client({307 connectionString: process.env.DATABASE_URL308});309310// Or use a secret manager311import { SecretManagerServiceClient } from '@google-cloud/secret-manager';312313const client = new SecretManagerServiceClient();314const [version] = await client.accessSecretVersion({315 name: 'projects/my-project/secrets/db-password/versions/latest',316});317const dbPassword = version.payload?.data?.toString();318```319320### Iyerarkhiya upravlinnya sekretamy321322```mermaid323graph TD324 A[Secret Manager\nAWS Secrets Manager\nGCP Secret Manager\nHashiCorp Vault] --> B[Best: Rotated, audited, centralized]325 C[Environment Variables\nInjected at deploy time] --> D[Good: Not in code, but static]326 E[.env files\nWith .gitignore] --> F[Acceptable: Local development only]327 G[Hard-coded in source] --> H[NEVER: Instant breach risk]328329 style A fill:#d4edda330 style C fill:#fff3cd331 style E fill:#ffeeba332 style G fill:#f8d7da333```334335## OWASP Top 10: Korotka dovidka336337Kozhnyy rozrobnyk povynen znaty OWASP Top 10. Stysnuta versiya:338339| # | Vrazlyvist | Shcho tse | Zapobihannya |340|---|-----------|---------|-------------|341| 1 | **Broken Access Control** | Korystuvachi otrymuyut dostup do resursiv, do yakykh ne povynni maty | Zaborona za zamovchuvannyam, validatsiya na storone servera |342| 2 | **Cryptographic Failures** | Slabke shyfruvannya, dani u vidkrytomu vyhlyadi | Sylni alhorytmy (AES-256, bcrypt), TLS vsyudy |343| 3 | **Injection** | SQL, NoSQL, OS command injection | Parametryzovani zapyty, validatsiya vkhidnykh danykh |344| 4 | **Insecure Design** | Khybna arkhitektura | Modelyuvannya zahroz, bezpechni shablony proyektuvannya |345| 5 | **Security Misconfiguration** | Oblikovi dani za zamovchuvannyam, vidkryti cloud buckety | Zmitsneni nalashtuvannya za zamovchuvannyam, avtomatyzovani audyty konfighuratsiyi |346| 6 | **Vulnerable Components** | Vidomi CVE v zalezhnostyakh | Skanuvannya SCA, rehuyarni onovlennya |347| 7 | **Auth Failures** | Slabki paroli, porusheni sesiyi | MFA, rate limiting, bezpechne keruvannya sesiyamy |348| 8 | **Data Integrity Failures** | Nepidpysani onovlennya, nedovireni CI/CD | Pidpys kodu, SBOM, tsilisnist pipeline |349| 9 | **Logging Failures** | Nemaye audytorskoho slidu | Strukturovane lohuvannya, spovishchennya pro anomaliyi |350| 10 | **SSRF** | Server-side request forgery | Allowlist vykhidnykh URL, validatsiya vkhidnykh danykh |351352## Povnyy workflow bezpeky GitHub Actions353354Povnyy, hotovyy do produktsiyi workflow, shcho poyednuye vse vyshchevkazane:355356```yaml357# .github/workflows/security.yml358name: Security Pipeline359on:360 pull_request:361 branches: [main]362 push:363 branches: [main]364365permissions:366 contents: read367 security-events: write368369jobs:370 secrets-scan:371 name: Secret Detection372 runs-on: ubuntu-latest373 steps:374 - uses: actions/checkout@v4375 with:376 fetch-depth: 0377 - uses: gitleaks/gitleaks-action@v2378 env:379 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}380381 sast:382 name: Static Analysis (SAST)383 runs-on: ubuntu-latest384 steps:385 - uses: actions/checkout@v4386 - uses: semgrep/semgrep-action@v1387 with:388 config: p/owasp-top-ten p/typescript p/nodejs389390 dependency-audit:391 name: Dependency Scan (SCA)392 runs-on: ubuntu-latest393 steps:394 - uses: actions/checkout@v4395 - uses: actions/setup-node@v4396 with:397 node-version: 22398 - run: npm ci399 - run: npm audit --audit-level=high400 - uses: snyk/actions/node@master401 env:402 SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}403 with:404 args: --severity-threshold=high405 continue-on-error: true406407 container-scan:408 name: Container Scan409 runs-on: ubuntu-latest410 needs: [sast, dependency-audit]411 steps:412 - uses: actions/checkout@v4413 - run: docker build -t app:${{ github.sha }} .414 - uses: aquasecurity/trivy-action@master415 with:416 image-ref: app:${{ github.sha }}417 severity: CRITICAL,HIGH418 exit-code: '1'419420 sbom:421 name: SBOM Generation422 runs-on: ubuntu-latest423 needs: [container-scan]424 steps:425 - uses: actions/checkout@v4426 - uses: anchore/sbom-action@v0427 with:428 format: spdx-json429 output-file: sbom.spdx.json430```431432```mermaid433graph TD434 PR[Pull Request] --> S1[Secret Detection]435 PR --> S2[SAST - Semgrep]436 PR --> S3[SCA - Snyk + npm audit]437 S2 --> S4[Container Scan - Trivy]438 S3 --> S4439 S4 --> S5[SBOM Generation]440 S5 --> Deploy[Deploy]441442 S1 -.- F1[Block if secrets found]443 S2 -.- F2[Block on critical vulns]444 S3 -.- F3[Block on high severity]445 S4 -.- F4[Block on critical CVEs]446```447448## Metryky dlya vidstezhennya449450Yak diznaty, chy pratsyuye vasha prohrama DevSecOps? Vidstezhuite tsi metryky:451452- **Mean time to remediate (MTTR)**: yak shvydko vy vypravlyayete vrazlyvosti pislya yikh vyyavlennya453- **Vulnerability escape rate**: vidsotok vrazlyvostey, shcho dosyahayut produktsiyi454- **False positive rate**: zanadto bahato khybnykh spatsyuvan pryzvodyt do vtomy vid spovishchen ta ihnoruvannya poperedzhen455- **Dependency freshness**: seredniy vik vashykh zalezhnostey (starishi = vyscha ymovirnist vidomykh CVE)456- **SBOM coverage**: vidsotok proektiv z aktualnymy SBOM457458## Pochatok roboty: Praktychna dorozhnya karta459460Ne namahaytesya vprovadyty vse odrazu. Poetapnyy pidkhid pratsyuye krashche:461462```mermaid463flowchart TD464 A[Week 1-2: Foundations] --> B[Week 3-4: CI/CD Integration]465 B --> C[Month 2: Container Security]466 C --> D[Month 3+: Advanced]467468 A --> A1[Add Gitleaks pre-commit hooks]469 A --> A2[Enable npm audit in CI]470 A --> A3[Add .gitignore for .env files]471472 B --> B1[Add Semgrep to GitHub Actions]473 B --> B2[Add Snyk dependency scanning]474 B --> B3[Set up SARIF upload to GitHub]475476 C --> C1[Add Trivy container scanning]477 C --> C2[Harden Dockerfiles]478 C --> C3[Generate SBOMs]479480 D --> D1[Secret manager integration]481 D --> D2[Runtime protection - DAST]482 D --> D3[Policy as code - OPA]483```484485## Vysnovok486487DevSecOps - tse ne pro dodavannya bilshe instrumentiv do vashoho pipeline - tse pro te, shchob zrobyty bezpeku pryrodnoyu chastynoyu toho, yak vy stvoryuyete prohramne zabezpechennya. Meta - ne blokuvaty kozhnyy PR poperedzhennyamy bezpeky, a davaty rozrobnykam shvydkyy zvorotniy zvyazok, shchob vony mohly vypravlyaty problemy, poky kod shche svizhyy v yikhniy pamyati.488489Pochayete z osnov: pre-commit hooks dlya sekretiv, skanuvannya zalezhnostey v CI ta skanuvannya konteyneriv dlya obraziv Docker. Potim iteruyte na osnovi toho, shcho potribno vashiy komandi.490491Bezpeka - tse ne funktsiya, yaku vy vyypuskayete odyn raz. Tse praktyka, yaku vy vbudovuyete v kozhnyy commit.492493> **Chek-lyst DevSecOps dlya startu:**494>495> - [x] Vstanovleni pre-commit hooks Gitleaks496> - [x] Fayly .env ta fayly z sekretamy v .gitignore497> - [x] Semgrep SAST v CI pipeline498> - [x] Snyk abo npm audit dlya skanuvannya zalezhnostey499> - [x] Trivy dlya skanuvannya obraziv konteyneriv500> - [x] Ne-root korystuvach v Dockerfile501> - [x] Sekrety v zminnykh otochennya abo secret manager502> - [x] Heneratsiya SBOM pry kozhnomu relizi503> - [x] Obiznanist shchodo OWASP Top 10 v usiy komandi504
:DevSecOps dlya rozrobnykiv: Praktychnyy posibnyk z shift-left securitylines 1-504 (END) — press q to close