Pipeline Integration

Integrating Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) into CI/CD pipelines is critical for automating vulnerability detection. By embedding these tools into the development lifecycle, teams can identify security issues early, reduce remediation costs, and enforce compliance with security policies. This section demonstrates how to configure SAST and DAST scans within CI/CD workflows, using common tools and pipeline configurations.

---

## Tool Selection and Pipeline Stages  
Before integration, select SAST and DAST tools that align with your stack and security requirements:  
- **SAST Tools**: SonarQube, Fortify, Checkmarx, or Snyk. These analyze source code for vulnerabilities, code smells, and security misconfigurations.  
- **DAST Tools**: OWASP ZAP, Burp Suite, or Acunetix. These simulate attacks on running applications to detect runtime vulnerabilities.  

Integrate these tools into the following pipeline stages:  
1. **SAST**: Run during the build phase to analyze source code.  
2. **DAST**: Execute during integration or acceptance testing to scan deployed artifacts.  

---

## Example: GitHub Actions Integration  
Here’s a GitHub Actions workflow that runs SAST and DAST scans:  

```yaml
name: Security Scan
on: [push]

jobs:
  sast-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Configure SAST
        run: |
          echo "Running SAST with SonarQube..."
          sonar-scanner -Dsonar.projectKey=my-project -Dsonar.sources=.
          SONAR_EXIT_CODE=$?
          if [ $SONAR_EXIT_CODE -ne 0 ]; then
            echo "SAST scan failed with exit code $SONAR_EXIT_CODE."
            exit $SONAR_EXIT_CODE
          fi

  dast-scan:
    runs-on: ubuntu-latest
    needs: sast-scan
    steps:
      - name: Deploy Test Artifact
        run: |
          echo "Deploying test environment..."
          # Example: Use Docker or Kubernetes to deploy a test instance
      - name: Run DAST
        run: |
          echo "Scanning with OWASP ZAP..."
          zap-cli scan -u http://test-app:8080
          ZAP_EXIT_CODE=$?
          if [ $ZAP_EXIT_CODE -ne 0 ]; then
            echo "DAST scan failed with exit code $ZAP_EXIT_CODE."
            exit $ZAP_EXIT_CODE
          fi

---

Example: Jenkins Pipeline

For Jenkins, define a pipeline that triggers SAST and DAST scans:

pipeline {
  agent any
  stages {
    stage('SAST') {
      steps {
        script {
          def sonarExitCode = sh(script: 'sonar-scanner -Dsonar.projectKey=my-project -Dsonar.sources=.', returnStatus: true)
          if (sonarExitCode != 0) {
            error "SAST scan failed with exit code $sonarExitCode."
          }
        }
      }
    }
    stage('DAST') {
      steps {
        script {
          def zapExitCode = sh(script: 'zap-cli scan -u http://test-app:8080', returnStatus: true)
          if (zapExitCode != 0) {
            error "DAST scan failed with exit code $zapExitCode."
          }
        }
      }
    }
  }
}

---

Best Practices

1. Early Integration: Run SAST during the build phase to catch issues in source code.
2. Automated Thresholds: Configure tools to fail builds if critical vulnerabilities are detected.
3. Environment Isolation: Use separate test environments for DAST scans to avoid disrupting production.
4. False Positive Management: Regularly update tool configurations to reduce false positives.
5. Combine with Other Controls: Integrate SAST/DAST with IaC validation, secret scanning, and runtime monitoring for holistic security.

---

Key takeaways

• Embed SAST and DAST scans into CI/CD pipelines to enforce security at every stage.
• Use standardized tools like SonarQube (SAST) and OWASP ZAP (DAST) for consistent results.
• Automate scan failures to enforce compliance and prioritize remediation.
• Isolate test environments for DAST to avoid production disruptions.
• Combine SAST/DAST with other DevSecOps practices for end-to-end security. ```