Secure Coding & OWASP Top 10 for Backend · レッスン

CI/CDへのセキュリティ統合（DevSecOps）

継続的インテグレーション／継続的デリバリーのパイプラインにセキュリティチェックとツールを組み込み、自動化することで、セキュリティ対策を開発工程の早期に移行します。

「CI/CDへのセキュリティ統合（DevSecOps）」はCoddyKit上の無料Secure Coding & OWASP Top 10 for Backendレッスンです。これはレッスン1/4です。下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。これはSecure Coding & OWASP Top 10 for Backend学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Secure Coding & OWASP Top 10 for Backendコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

What is DevSecOps?

Welcome to integrating security into your CI/CD pipeline! This is a core part of DevSecOps, a philosophy that aims to integrate security practices into every stage of the software development lifecycle.

The key idea is to "shift left", meaning we bring security considerations and checks to the earliest possible phases, rather than waiting until the end.

Why Automate Security?

Integrating security directly into your Continuous Integration/Continuous Delivery (CI/CD) pipeline offers major benefits:

Early Detection: Catch vulnerabilities when they are cheaper and easier to fix.
Faster Feedback: Developers get immediate alerts about security issues.
Consistency: Ensure security checks are run uniformly on every code change.
Automation: Reduce manual effort and human error in security reviews.

Static Analysis (SAST)

Static Application Security Testing (SAST) tools scan your application's source code, bytecode, or binary code without executing it.

SAST helps identify common vulnerabilities like:

SQL Injection flaws
Cross-Site Scripting (XSS) issues
Insecure configurations
Hardcoded credentials

These checks happen early, often right after a code commit.

SAST Example: Hardcoded Secret

SAST tools look for patterns in your code. Consider this Java example where an API key is hardcoded. A SAST tool would flag this as a potential security risk.

Running this code will just print the key, but in a real app, hardcoding secrets is a major no-no!

public class SecurityCheck {
  public static void main(String[] args) {
    String apiKey = "YOUR_HARDCODED_API_KEY_123"; // SAST would flag this!
    System.out.println("Using key: " + apiKey);
    
    // In secure applications, sensitive data like API keys
    // should be loaded from secure environment variables
    // or a dedicated secrets management service.
  }
}

Software Composition Analysis (SCA)

Modern applications rely heavily on open-source libraries and third-party components. Software Composition Analysis (SCA) tools scan your project's dependencies.

SCA helps you:

Identify known vulnerabilities (CVEs) in your libraries.
Track outdated or unmaintained components.
Manage open-source license compliance.

This ensures you're not inheriting security risks from external code.

Dynamic Analysis (DAST)

While SAST inspects code, Dynamic Application Security Testing (DAST) tools test your application while it's running. They simulate attacks against the deployed application.

DAST can find vulnerabilities that SAST might miss, such as:

Server misconfigurations
Authentication issues
Session management flaws
Business logic vulnerabilities

It acts like an automated hacker, finding weaknesses from the outside.

Container Security Scanning

If you're using containers (like Docker), Container Security Scanning is crucial. These tools analyze your container images.

They check for:

Known vulnerabilities in the operating system layers.
Outdated or insecure packages within the image.
Misconfigurations that could expose your container.

Scanning happens before deployment, preventing vulnerable images from running.

Infrastructure as Code (IaC) Security

Many teams now manage their infrastructure using code (e.g., Terraform, CloudFormation). IaC Security Scanning tools check these configuration files.

They identify:

Insecure firewall rules
Overly permissive IAM roles
Unencrypted storage buckets
Other cloud misconfigurations

This ensures your infrastructure is secure from the moment it's provisioned.

Security Gates & Breaking Builds

A critical part of CI/CD security is implementing security gates. These are rules that determine if a pipeline should proceed or fail based on security scan results.

For example, if a SAST scan finds a critical vulnerability, the build can automatically "break". This prevents insecure code from being deployed, forcing developers to fix issues before moving forward.

Quick Check: DevSecOps Tools

You've learned about several tools that integrate security into CI/CD. Which of the following tools or practices are primarily focused on checking your code or dependencies before the application is fully running?

Recap: Shifting Security Left

In this lesson, we explored how to integrate security into your CI/CD pipeline, embracing the DevSecOps philosophy. You learned about:

SAST: Static code analysis for early vulnerability detection.
SCA: Identifying risks in third-party dependencies.
DAST: Testing running applications for runtime flaws.
Container & IaC Security: Securing your deployment artifacts and infrastructure.
Security Gates: Automatically preventing vulnerable code deployment.

By shifting security left, you build more secure applications from the ground up!

よくある質問

「CI/CDへのセキュリティ統合（DevSecOps）」レッスンは無料ですか？

はい。「CI/CDへのセキュリティ統合（DevSecOps）」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Secure Coding & OWASP Top 10 for Backendコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Secure Coding & OWASP Top 10 for Backendコースには全4レッスンが含まれています。

「CI/CDへのセキュリティ統合（DevSecOps）」で何を学びますか？

継続的インテグレーション／継続的デリバリーのパイプラインにセキュリティチェックとツールを組み込み、自動化することで、セキュリティ対策を開発工程の早期に移行します。ブラウザで直接実行するハンズオンコードでSecure Coding & OWASP Top 10 for Backendを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

Secure Coding & OWASP Top 10 for Backendを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのSecure Coding & OWASP Top 10 for Backendは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。これはレッスン1/4です。

「CI/CDへのセキュリティ統合（DevSecOps）」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このSecure Coding & OWASP Top 10 for Backendレッスンでコードを書いて実行できますか？

はい。すべてのSecure Coding & OWASP Top 10 for Backendレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

← Secure Coding & OWASP Top 10 for Backendに戻る