Enhancing SDLC with Security: A Guide to SSDL and CI/CD Pipelines

Welcome back! In my last blog post, we explored the SDLC and CI/CD pipeline processes. Today, we’ll discuss how these concepts extend into SSDL with CI/CD pipelines.

Previously, we covered essential topics including the fundamentals of SDLC, its importance, its various phases, and how CI/CD pipelines work. We also examined both traditional and modern CI/CD pipeline methods, and how organizations can scale their pipelines based on business needs.

If you need a refresher/not yet familiar with SDLC and its relationship with CI/CD pipelines, I encourage you to review my previous blog post. Now, let’s dive into today’s topic!

https://dev.to/malar_nath/from-sdlc-to-cicd-a-beginners-guide-2l39

What is Secure Software Development Lifecycle (SSDL)?

It is an approach to SDLC that integrated security practices in each phases of the Software Development Lifecycle. Here, the primary goal for this SSDL is to identify and address security vulnerabilities early, minimizing risks and ensuring the final product is secure.

With this information let’s move on to the Phases of SDLC with security in mind :)

Focusing on Each Phase: SDLC + Secure SDLC (SSDL):

1. Planning —
SDLC Goal: Define project goals, scope, and resources.

SSDL Enhancement: Set security objectives, perform preliminary threat modeling, and align with compliance requirements (e.g., PCI DSS, GDPR).

Example:

For an e-commerce website, security goals include payment data encryption, maintaining uptime during peak sales, and ensuring PCI DSS compliance for protecting cardholder data.

2. Requirement Analysis —

SDLC Goal: Understand what software must do and gather functional and non-functional requirements.

SSDL Enhancement: Identify security-specific requirements like authentication, data encryption, and compliance integration (e.g., GDPR, HIPAA).

Functional: User authentication, access authorization, and secure data encryption.

Non-functional: System uptime, performance scaling, and security incident handling (In short, it ensures the functionality of enabling easy browsing, checkout systems, and efficient order tracking with best practices such as compliance implementation identifying risk).

Example:

Stakeholders require the payment gateway to implement two-factor authentication and TLS encryption for all financial transactions.

3. Design —

SDLC Goal: Architect the software with workflows, modules, and database schemas.

SSDL Enhancement: Use frameworks like STRIDE to detect potential threats such as spoofing, tampering, and data breaches. Apply secure design principles like least privilege, defense in depth, and secure defaults.

Example:

In an e-commerce system, the customer payment database is kept separate from the application server to prevent unauthorized access.

The CI/CD process (Continuous Integration and Continuous Deployment/Delivery) starts in the Development phase of the SDLC and extends through Testing, Deployment, and into the Maintenance phase.

Let’s explore how it fits into the SSDL process:

4. Development (Implementation) —

SDLC Goal: Write and integrate code based on design documents.

SSDL Enhancement: Code review will happen as part of Secure Coding Practices using SAST tool.

What happens here?

• Developers write the code for e-commerce application in IDE’s or Git.
• Developers push their code to a shared repository (e.g., GitHub or GitLab).
• CI tools like Jenkins, GitLab CI, or CircleCI gets trigger/update and automatically fetch the code, build it, and run automated tests (unit and integrated test will happen to ensure the code works as expected).
• Integration checks verify that new code maintains compatibility with existing functionality.

Security Perspective:

• The CI pipeline integrates SAST (Static Application Security Testing) tools to scan code for security vulnerabilities (e.g., hardcoded secrets or SQL injection risks).
• Note: How CI pipeline perform SAST scan? Well, In CI Pipeline, for example Jenkins, it have plugins which is integrated into CI pipeline. Many SAST tools provide dedicated plugins for CI/CD platforms like Jenkins, GitLab CI, or Azure DevOps. Tools like SonarQube, Checkmarx, and Fortify offer plugins that can be added to the CI pipeline.

How It Works:

• The CI tool (Jenkins) installs the SAST plugin.
• During the build or testing phase, the plugin automatically scans the source code.
• The CI/CD dashboard displays the scan results, highlighting any vulnerabilities or code quality issues.
• However, command-line and API methods are also common when a plugin isn’t available.

Example: When developers implement new payment features for an e-commerce site, Jenkins initiates a build to verify functionality and employs SonarQube to detect potential security flaws.

5. Testing —

SDLC Goal: Identify and fix bugs through functional and performance

SSDL Enhancement: Code reviews and Penetration Testing will happen using SAST, DAST, Burpsuite, OWASP ZAP tool.

What happens here?

• The CI/CD pipeline runs comprehensive automated tests, including unit, integration, performance, and security testing.
• DAST (Dynamic Application Security Testing) tools like OWASP ZAP or Burp Suite test the application’s security by simulating real-world attacks.

Security Perspective:

• This testing catches critical vulnerabilities like cross-site scripting (XSS) and insecure APIs before they reach production.

Example: For the e-commerce site, DAST tools verify that the login system is protected against brute force attacks and session hijacking attempts.

6. Deployment(Continuous Deployment — CD) —

SDLC Goal: Launch the software in a production environment.

SSDL Enhancement: Here before sending the build artifacts to CD tools (e.g., Ansible or Kubernetes), it ensure the hardening configurations for servers, databases, APIs are well and secure to move. Deploy monitoring tools (e.g., Splunk, New Relic) to track system performance and detect potential breaches.

What happens here?

Security Perspective:

• After the tests are completed, the code is packaged into deployable artifacts (e.g., Docker images, JAR files).
• This build artifact is then pushed to JFrog Artifactory for storage.
• While Jenkins doesn’t initially know the artifactory repository location, it uses integrated plugins to interact with artifactory repository hubs like JFrog, AWS, Azure, and GCP.
• Jenkins shares the compiled executable files with these hubs through artifactory plugins.
• For additional security testing or containerization, Jenkins retrieves the artifacts from the artifactory repository to create Docker images (If it is for large-scale application. For small scale, we can just move the build artifact to deployment process directly).
• The artifact is incorporated into a Dockerfile, which defines the container’s environment.
• These Docker images are then sent back to the artifactory repository for container security scans and storage.
• Security professionals review the registry repository and application image, conducting security scans.
• Once security professionals confirm no vulnerabilities exist, developers retrieve the build artifacts from the artifactory repository through Jenkins for the deployment process.
• Deployment tools like Ansible, Kubernetes, or Spinnaker handle the automated rollout to staging or production environments.

Example: Ansible deploys a new version of the e-commerce site while maintaining the database’s security rules.

7. Maintenance (Continuous Monitoring and Updates) —

SDLC Goal: Ensure the software runs smoothly post-deployment with regular updates and patches.

SSDL Enhancement: Continuous monitoring with SIEM tools (e.g., Splunk, QRadar) helps detect unusual activities. Regular patch management ensures updates to libraries, frameworks, and tools to mitigate vulnerabilities, and a documented incident response plan is in place to detect, respond to, and recover from security incidents.

What happens here?

• Continuous monitoring tools (e.g., Splunk, Dynatrace) track application performance and detect anomalies.
• When vulnerabilities are discovered in libraries or frameworks, CD pipelines are triggered to patch and deploy updates.

Example: The CI/CD pipeline automates patching a vulnerable library in the e-commerce payment module.

Lastly,

SSDL integrates security measures into every stage of software development. Without SSDL, security checks would only occur in the final phases of SDLC, risking the oversight of major vulnerabilities. Instead, SSDL helps identify and fix problems from the initial phase through completion. Through CI/CD pipelines, teams can automate security tasks, accelerate development, and ensure software is both functional and secure from the start. Hope we’ve explored the complete process of SDLC, SSDL, and their integration with the CI/CD pipeline process.

In the next blog, we’ll dive into another exciting topic. Stay tuned for more insights!