Continue # Infosys Whitepaper 
 set  up a pre-production or staging environment and deploy the web  application. The set-up enables DAST to run in the CI/CD pipeline as  a part of integration testing. Let us consider an example using the  widely available open-source DAST tool, Zed Attack Proxy (ZAP).  Some of the key considerations for integrating DAST in the CI/CD  pipeline using ZAP (see Figure 3) are listed below: •  Test on the developer machine before moving the code to the  CI/CD server and the Gitlab CI/CD •  Set up the CI/CD server and Gitlab. Ensure ZAP container  readiness with Selenium on Firefox, along with custom scripts  •  Reuse the functional automation scripts, only modifying them  for security testing use cases and data requirements •  Push all the custom scripts to the Git server and pull the latest  code. Run the pipeline after meeting all prerequisites  

---

  Page: 6 / 8  

---

  Some of the key considerations for integrating DAST in the CI/CD pipeline using ZAP (see Figure 3) are listed below: •  Test on the developer machine before moving the code to the CI/CD server and the Gitlab CI/CD •  Set up the CI/CD server and Gitlab. Ensure ZAP container readiness with Selenium on Firefox, along with custom scripts  •  Reuse the functional automation scripts, only modifying them for security testing use cases and data requirements •  Push all the custom scripts to the Git server and pull the latest code. Run the pipeline after meeting all prerequisites  

---

  Page: 7 / 8  

---

  DevSecOps with DAST in the cloud Integrating DAST with cloud CI/CD requires a different approach.  Approach: •  Identify, leverage, and integrate cloud-native CI/CD services, continuous logging and monitoring services, auditing, and governance     services, as well as operation services with regular CI/CD tools – mainly DAST •  Control all CI/CD jobs with server and slave architecture by using containers, such as Docker, to build and deploy applications as cloud     orchestration tools.<|endoftext|>An effective DAST DevSecOps in cloud architecture appears as shown in Figure 4: Best practices •  Control access to pipeline resources     using identity and access management     (IAM) roles and security policies  •  Encrypt data at transit and rest always •  Store sensitive information, such as     API tokens and passwords, in the      Secrets Manager  Key steps 1. The user commits the code to a code repository 2. The tool builds artifacts and uploads them to the artifact library 3. Integrated tools help perform the SCA and SAST tests 4. Reports of critical/high-failure vulnerabilities from the SCA and  SAST scans go to the security dashboard for fixing 5. Code deployment to the staging environment takes place if  reports indicate “no or ignore vulnerabilities” 6. Successful deployment triggers a DAST tool, such as the OWASP  ZAP, for scanning  7. User repeats steps 4 to 6 in the event of a vulnerability  detection  8. If no vulnerabilities are reported, the workflow triggers an  approval email.<|endoftext|>9. Receipt of approval schedules automatic deployment to  production Figure 4: DAST DevSecOps in Cloud Workflow 

---

  Page: 8 / 8  

---

 © 2023 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com  Infosys.com | NYSE: INFY Stay Connected About the authors Kedar J Mankar Kedar J Mankar is an Infosys global delivery  lead for Cyber Security testing with Infosys.  He has extensive experience across  different software testing types. He has  led large size delivery and transformation  programs for global Fortune 500 customers  and delivered value through different COEs  with innovation at core. He has experience  working and handling teams in functional,  data, automation, DevOps, performance  and security testing across multiple  geographies and verticals.<|endoftext|>Amlan Sahoo  Amlan Sahoo has an overall 27+ years in IT  industry in application development and  testing. He is currently the head of Cyber  Security testing division. He has a proven  track record in managing and leading  transformation programs with large  teams for Fortune 50 clients, managing  deliveries across multiple geographies and  verticals. He also has 4 IEEE and 1 IASTED  publications to his credit on bringing  efficiencies in heterogeneous software  architectures.<|endoftext|>Vamsi Kishore  Vamsi Kishore Sukla is a Security  consultant with over 8 years of professional  experience in the security field, specializing  in application security testing, cloud  security testing, network vulnerability  assessments following OWASP standards  and CIS benchmarks. With a deep  understanding of the latest security trends  and tools, he provides comprehensive  security solutions to ensure the safety and  integrity of organization and clients.<|endoftext|>Conclusion DevOps is becoming a reality much faster than we anticipate. However, there should  be no compromise on security testing to avoid delayed deployments and the risk  of releasing software with security vulnerabilities. Successful DevSecOps requires  integrating security at every stage of DevOps, enabling DevOps teams on security  characteristics, enhancing the partnership between DevOps teams and security  SMEs, automating security testing to the extent possible, and shift-left security  for early feedback. By leveraging the best practices recommended in this paper,  organizations can achieve a more secure and faster release by as much as 15%, both  on-premises and in the cloud.<|endoftext|>References 1. https://www.cobalt.io/blog/cybersecurity-statistics-2023 2. https://cybersecurityventures.com/boardroom-cybersecurity-report/ 3. https://strongdm.com/blog/devsecops-statistics   


***


  