Belajar Security Tester - Security Testing as Code

#Pendahuluan

Setelah di episode 23 kita menguji AI/LLM applications, pada episode ini kita membahas pendekatan modern: security testing as code. Daripada manual testing yang tidak reproducible, security tests ditulis dalam code yang bisa di-version, di-review, dan di-run secara konsisten.

#Concept: Security as Code

text

Security Testing as Code:
├── Test definitions dalam code (bukan manual docs)
├── Automated execution di CI/CD
├── Version controlled (git)
├── Reproducible results
├── Reviewable (PR process)
└── Reportable (automated reporting)

#Test Definition as Code

#Semgrep Custom Rules

yaml

# .semgrep/custom-rules.yml
rules:
  - id: hardcoded-secret
    pattern: |
      password = "..."
    message: "Hardcoded password detected"
    languages: [python]
    severity: ERROR
 
  - id: sql-injection
    pattern: |
      $QUERY = "..." + $INPUT
    message: "Potential SQL injection"
    languages: [python]
    severity: WARNING

#Security Test Scripts

bash

#!/bin/bash
# security-tests.sh - Security test suite
 
set -e
 
echo "=== SAST Scan ==="
semgrep --config p/owasp-top-ten --json .
 
echo "=== SCA Audit ==="
npm audit --audit-level=high
 
echo "=== Secret Scan ==="
trufflehog filesystem .
 
echo "=== Container Scan ==="
trivy image --severity HIGH,CRITICAL $IMAGE_NAME
 
echo "=== All security tests passed ==="

#Test Data Management

#Secure Test Data

bash

# Generate test data yang aman
# 1. Fake data (bukan real PII)
faker-cli --locale=en generate email 100
 
# 2. Anonymized production data
anonymize-db --input prod-dump.sql --output test-dump.sql
 
# 3. Synthetic data
python generate-test-data.py --count 1000 --output test-data.json

#Test Environment Isolation

yaml

# docker-compose.test.yml
version: '3.8'
services:
  app:
    build: .
    environment:
      - DATABASE_URL=postgresql://test:test@db:5432/test
      - REDIS_URL=redis://redis:6379
  db:
    image: postgres:16
    environment:
      POSTGRES_DB: test
      POSTGRES_USER: test
      POSTGRES_PASSWORD: test
  redis:
    image: redis:alpine

#Reproducibility

#Deterministic Scans

bash

# Pin tool versions
semgrep --version  # Pastikan version konsisten
trivy --version
 
# Pin config versions
# .semgrep/config.yml → commit ke git
# .trivyignore → commit ke git

#Baseline Management

bash

# Simpan baseline
semgrep --config p/owasp-top-ten --json . > baseline/semgrep.json
npm audit --json > baseline/npm-audit.json
 
# Di CI, bandingkan
semgrep --config p/owasp-top-ten --json . > current/semgrep.json
diff baseline/semgrep.json current/semgrep.json

#Reporting as Code

bash

# Generate report dari scan results
python generate-report.py \
  --semgrep current/semgrep.json \
  --npm-audit current/npm-audit.json \
  --trivy current/trivy.json \
  --output security-report.html
 
# Upload ke dashboard
curl -X POST https://security-dashboard.internal/api/reports \
  -F "report=@security-report.html" \
  -F "branch=$(git branch --show-current)"

Tip

Mulai dengan security-tests.sh yang menjalankan semua scan. Setelah itu, refactor menjadi pipeline CI/CD yang terpisah per scan type.

#Praktik: Security Test Repo

bash

# 1. Buat security test script
cat > security-tests.sh << 'EOF'
#!/bin/bash
set -e
echo "Running security tests..."
semgrep --config p/owasp-top-ten --json .
npm audit --audit-level=high
EOF
chmod +x security-tests.sh
 
# 2. Jalankan
./security-tests.sh
 
# 3. Commit ke git
git add security-tests.sh
git commit -m "chore: add security test suite"

#Penutup

Definition as code: security tests dalam code, bukan manual docs.
Test data: fake/anonymized data, test environment isolation.
Reproducibility: pin versions, baseline management.
Reporting: automated report generation dan upload ke dashboard.

Di episode 25 selanjutnya kita akan membahas security test automation framework — membangun reusable framework, coverage metrics, dan shared libraries. Sampai jumpa di episode 25!