Otomatisasi Keamanan

Keamanan manual tidak bisa scale. Dengan otomatisasi, kita bisa mendeteksi vulnerability lebih awal, lebih cepat, dan lebih konsisten. Pendekatan ini dikenal sebagai DevSecOps — mengintegrasikan security ke dalam setiap tahap DevOps pipeline, bukan menambahkannya di akhir.

Security dalam SDLC (Software Development Life Cycle)

• Design — Threat modeling
• Code — SAST (Static Analysis), linting, pre-commit hooks
• Build — Dependency scanning, container scanning
• Test — DAST (Dynamic Analysis), security testing
• Deploy — Configuration scanning, secret detection
• Monitor — Runtime protection, logging, alerting

Tools per Kategori

1. SAST (Static Application Security Testing)

# Semgrep — multi-language, free
semgrep --config auto .
# Atau dengan rules spesifik
semgrep --config p/owasp-top-ten .

# PHPStan dengan rules security
vendor/bin/phpstan analyse --level=max

# ESLint security plugin
npx eslint --plugin security src/

2. DAST (Dynamic Application Security Testing)

# OWASP ZAP — scan running application
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
    -t https://target.com

# Nikto — web server scanner
nikto -host https://target.com

# Nuclei — template-based scanner
nuclei -u https://target.com -t cves/

3. Dependency Scanning

# npm audit di CI/CD
npm audit --audit-level=high --production

# Snyk
snyk test --severity-threshold=high

# Trivy (untuk dependencies dan containers)
trivy fs --security-checks vuln .

4. Secret Detection

# TruffleHog — scan git history untuk secrets
trufflehog git https://github.com/org/repo --only-verified

# GitLeaks — pre-commit hook
gitleaks detect --source .

# Pre-commit hook configuration
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

CI/CD Security Pipeline

# .github/workflows/security.yml
name: Security Pipeline
on: [push, pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/owasp-top-ten

  dependency-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm audit --audit-level=high

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2

  container-scan:
    runs-on: ubuntu-latest
    needs: [sast, dependency-check]
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t myapp .
      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp
          severity: HIGH,CRITICAL

Ringkasan Tools

• SAST: Semgrep, SonarQube, CodeQL, PHPStan
• DAST: OWASP ZAP, Nikto, Nuclei
• Dependencies: npm audit, Snyk, Trivy, Dependabot
• Secrets: TruffleHog, GitLeaks, git-secrets
• Containers: Trivy, Docker Scout, Snyk Container
• Headers: securityheaders.com, Mozilla Observatory

Best Practices

• Shift left — Deteksi vulnerability seawal mungkin di pipeline
• Automate everything — Jangan bergantung pada review manual saja
• Fail fast — Block PR/deploy jika ada high/critical vulnerability
• Reduce noise — Tune tools untuk mengurangi false positives
• Iterate — Mulai dari yang dasar, tingkatkan secara bertahap