Belajar Security Tester - Security Regression & Shift-Left

#Pendahuluan

Setelah di episode 15 kita menguji data & privasi, pada episode ini kita membahas filosofi yang mengubah cara tim membangun keamanan: shift-left security. Daripada testing di akhir development, security menjadi bagian dari setiap langkah.

#Apa itu Shift-Left Security?

Shift-left berarti memindahkan security testing ke awal development cycle — dari testing phase ke planning dan development phase.

text

Traditional: Plan → Develop → Test → Security → Deploy
Shift-Left:  Plan+Security → Develop+Security → Test+Security → Deploy

#Mengapa Shift-Left?

Aspek	Traditional	Shift-Left
Cost to fix	Mahal (production)	Murah (development)
Feedback loop	Lambat (hari/minggu)	Cepat (menit)
Coverage	Terbatas	Lebih luas
Developer awareness	Rendah	Tinggi

#Security Gates di CI/CD

#Pre-Commit Hooks

bash

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/semgrep/semgrep
    rev: v1.56.0
    hooks:
      - id: semgrep
        args: ['--config', 'p/owasp-top-ten', '--error']

#PR Security Gate

yaml

# .github/workflows/security-gate.yml
name: Security Gate
on: [pull_request]
jobs:
  security-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: SAST
        uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten
      - name: SCA
        run: npm audit --audit-level=high
      - name: Secret Scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

#Merge Blocking

yaml

# GitHub branch protection rules
# Require status checks to pass:
# - SAST Scan
# - SCA Audit
# - Secret Scan
# - Container Scan

#Security Testing di Development Loop

#IDE Integration

bash

# Semgrep di VS Code
# Install extension: Semgrep
# Auto-scan saat typing
 
# Trivy di IDE
# Scan dependencies saat adding package

#Fast Feedback

text

Target Feedback Time:
├── Pre-commit: < 30 seconds (SAST quick scan)
├── PR check: < 5 minutes (SAST + SCA + Secret scan)
├── Staging: < 30 minutes (DAST full scan)
└── Production: < 24 hours (monitoring + alerts)

#Regression Prevention

#Security Test Baseline

bash

# Simpan baseline security findings
semgrep --config p/owasp-top-ten --json . > security-baseline.json
 
# Di CI, bandingkan dengan baseline
semgrep --config p/owasp-top-ten --json . > current.json
 
# Fail jika ada new findings
diff security-baseline.json current.json

#Vulnerability Tracking

text

Track & Prevent Regression:
├── Simpan semua findings di issue tracker
├── Setiap fix: tambah test case untuk mencegah regression
├── Monitor: vulnerability yang diperbaiki tidak muncul kembali
└── Alert: jika vulnerability lama muncul di scan

Tip

Mulai dari yang kecil: pre-commit hooks untuk SAST, lalu SCA di PR, lalu DAST di staging. Jangan coba implementasi semuanya sekaligus.

#Praktik: Setup Security Pipeline

yaml

# Minimal security pipeline
name: Security
on: [push, pull_request]
jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten
 
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=high

#Penutup

Shift-left: security testing di awal development, bukan di akhir.
Security gates: pre-commit → PR check → staging → production.
Fast feedback: target < 5 menit untuk PR checks.
Regression prevention: baseline + tracking + test cases per fix.

Di episode 17 selanjutnya kita akan membahas testing third-party dependencies — SCA scanning, licensing risks, dan supply chain security. Sampai jumpa di episode 17!