Belajar Quality Engineer - Secure CI & Supply Chain Quality

#Pendahuluan

Setelah di episode 18 kita mempelajari production monitoring & shift-right, pada episode ini kita mempelajari secure CI & supply chain quality — bagaimana mengamankan CI/CD pipeline dan supply chain. Supply chain attacks meningkat pesat dan menjadi ancaman serius.

Mengapa secure CI & supply chain quality penting? Karena CI/CD pipeline adalah target utama attacker. Jika pipeline compromised, semua artifact yang dihasilkan bisa berisi malicious code.

#Supply Chain Security

#Ancaman Supply Chain

text

Supply Chain Threats:
├── Dependency Confusion:
│   ├── Malicious package dengan nama mirip
│   ├── Typosquatting
│   └── Namespace confusion
├── Compromised Dependencies:
│   ├── Maintainer account compromised
│   ├── Malicious code injection
│   └── Backdoor installation
├── Build Process:
│   ├── CI/CD compromised
│   ├── Build artifacts tampered
│   └── Secret extraction
└── Distribution:
    ├── Package registry compromised
    ├── Man-in-the-middle
    └── Tampered binaries

#SBOM (Software Bill of Materials)

text

SBOM:
├── Definition:
│   ├── Daftar semua komponen software
│   ├── Dependencies & versions
│   └── Licenses
├── Format:
│   ├── SPDX
│   ├── CycloneDX
│   └── SWID Tags
├── Tools:
│   ├── Syft
│   ├── CycloneDX CLI
│   └── SPDX Tools
└── Usage:
    ├── Vulnerability tracking
    ├── License compliance
    └── Incident response

#Secure CI/CD Pipeline

#Pipeline Security

text

Pipeline Security:
├── Source Code:
│   ├── Branch protection
│   ├── Code review required
│   ├── Signed commits
│   └── Secret scanning
├── Build:
│   ├── Isolated build environment
│   ├── Reproducible builds
│   ├── Build provenance
│   └── Artifact signing
├── Test:
│   ├── Test isolation
│   ├── Secure test data
│   └── Test environment security
└── Deploy:
    ├── Deployment approval
    ├── Environment protection
    ├── Secret management
    └── Audit logging

#Contoh Secure Pipeline

yaml

# .github/workflows/secure-ci.yml
name: Secure CI
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Secret Scanning
        uses: trufflesecurity/trufflehog@main
        
      - name: Dependency Scan
        run: npm audit --audit-level=high
        
      - name: SAST
        uses: github/codeql-action/analyze@v2
        
      - name: SBOM Generation
        run: syft . -o spdx-json > sbom.json
        
      - name: Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'

Note

SBOM harus digenerate untuk setiap build. Ini memungkinkan tracking semua dependencies dan vulnerability assessment secara continous.

#Practical: Supply Chain Checklist

yaml

supply_chain_checklist:
  dependencies:
    - lockfile_integrity
    - version_pinning
    - vulnerability_scanning
    - license_compliance
  build:
    - isolated_environment
    - reproducible_builds
    - artifact_signing
    - provenance_tracking
  ci_cd:
    - secret_management
    - access_control
    - audit_logging
    - pipeline_security
  monitoring:
    - dependency_updates
    - vulnerability_alerts
    - license_changes
    - security_advisories

Tip

Mulai dengan dependency scanning dan SBOM generation. Kedua ini bisa di-automate dengan mudah dan memberikan visibility ke supply chain.

#Penutup

Pada episode 19 ini, kalian telah mempelajari secure CI & supply chain quality.

Inti yang harus dibawa pulang:

Supply chain threats: dependency confusion, compromised dependencies, build process.
SBOM: software bill of materials untuk tracking dependencies.
Secure CI/CD: source code, build, test, deploy security.
Pipeline security: secret management, access control, audit logging.

Di episode 20 selanjutnya, kita akan membahas quality & compliance — bagaimana memastikan quality process comply dengan regulations. Sampai jumpa di episode 20!