Belajar Quality Engineer - Security Quality Engineering

#Pendahuluan

Setelah di episode 12 kita mempelajari performance engineering, pada episode ini kita mempelajari security quality engineering — bagaimana mengintegrasikan security testing ke dalam quality process. Security bukan hanya tanggung jawab security team, tapi semua orang termasuk QE.

Mengapa security quality engineering penting? Karena security breaches bisa merusak reputasi dan menyebabkan kerugian finansial besar. Dengan mengintegrasikan security ke dalam quality process, kalian bisa menemukan vulnerabilities sebelum attacker menemukannya.

#Security Gates

#Security Gate Strategy

text

Security Gates:
├── Pre-Commit:
│   ├── Secret scanning
│   ├── Linting security rules
│   └── Dependency check
├── Pre-Merge:
│   ├── SAST scan
│   ├── Dependency vulnerability scan
│   └── License check
├── Pre-Deploy:
│   ├── DAST scan
│   ├── Container scan
│   └── Infrastructure scan
└── Production:
    ├── Runtime protection
    ├── Monitoring
    └── Incident response

#SAST (Static Application Security Testing)

#SAST Tools

text

SAST Tools:
├── SonarQube:
│   ├── Code quality + security
│   ├── Multiple languages
│   └── CI/CD integration
├── Semgrep:
│   ├── Custom rules
│   ├── Fast scanning
│   └── Open source
├── ESLint Security:
│   ├── JavaScript/TypeScript
│   ├── Security rules
│   └── Custom plugins
└── Bandit:
    ├── Python
    ├── Security linting
    └── Configurable

#Contoh SAST Integration

yaml

# GitHub Actions SAST
- name: SAST Scan
  uses: github/codeql-action/analyze@v2
  with:
    languages: javascript
    
- name: SonarQube Scan
  uses: sonarcloud/sonarcloud-github-action@master
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

Note

SAST harus integrated ke CI/CD dan run setiap PR. Ini memberikan early feedback tentang security issues sebelum code di-merge.

#DAST (Dynamic Application Security Testing)

#DAST Tools

text

DAST Tools:
├── OWASP ZAP:
│   ├── Free & open source
│   ├── Automated scanning
│   └── API testing
├── Burp Suite:
│   ├── Industry standard
│   ├── Professional features
│   └── Community edition
└── Nuclei:
    ├── Template-based
│   ├── Fast scanning
│   └── Custom templates

#Shift-Left Security

#Security in Development

text

Shift-Left Security:
├── Design Phase:
│   ├── Threat modeling
│   ├── Security architecture
│   └── Security requirements
├── Development Phase:
│   ├── Secure coding practices
│   ├── SAST in IDE
│   └── Pre-commit hooks
├── Testing Phase:
│   ├── DAST scanning
│   ├── Penetration testing
│   └── Security review
└── Deployment:
    ├── Container scanning
    ├── Infrastructure as code scan
    └── Runtime protection

#Practical: Security Quality Checklist

yaml

security_quality:
  static:
    - sast_scan
    - secret_scanning
    - dependency_check
    - license_check
  dynamic:
    - dast_scan
    - api_security_test
    - authentication_test
  infrastructure:
    - container_scan
    - iac_scan
    - configuration_check
  process:
    - threat_modeling
    - security_review
    - incident_response

Tip

Mulai dengan SAST dan dependency scanning. Kedua ini bisa di-automate dengan mudah dan memberikan dampak signifikan terhadap security posture.

#Penutup

Pada episode 13 ini, kalian telah mempelajari security quality engineering.

Inti yang harus dibawa pulang:

Security gates: pre-commit → pre-merge → pre-deploy → production.
SAST: SonarQube, Semgrep, ESLint security.
DAST: OWASP ZAP, Burp Suite, Nuclei.
Shift-left security: security di setiap phase development.

Di episode 14 selanjutnya, kita akan membahas reliability & chaos testing — bagaimana menguji ketahanan sistem menggunakan chaos engineering. Sampai jumpa di episode 14!