Belajar Security Tester - Security Test Automation Framework

#Pendahuluan

Setelah di episode 24 kita membahas security testing as code, pada episode ini kita tingkatkan ke framework — membangun sistem security testing yang reusable, scalable, dan maintainable untuk tim.

#Framework Structure

text

security-test-framework/
├── config/
│   ├── targets.yml          # Target definitions
│   ├── scan-profiles.yml    # Scan configurations
│   └── severity-rules.yml   # Severity mapping
├── tests/
│   ├── sast/
│   │   ├── semgrep/
│   │   └── codeql/
│   ├── dast/
│   │   ├── zap/
│   │   └── nuclei/
│   ├── sca/
│   │   ├── npm-audit/
│   │   └── trivy/
│   └── manual/
│       ├── auth-testing/
│       └── api-testing/
├── lib/
│   ├── reporting.py         # Report generation
│   ├── notifications.py     # Alert system
│   └── utils.py             # Shared utilities
├── reports/                 # Generated reports
├── baselines/              # Scan baselines
├── security-tests.sh       # Main entry point
└── README.md

#Reusable Components

#Scan Profiles

yaml

# config/scan-profiles.yml
profiles:
  quick:
    sast:
      enabled: true
      config: p/owasp-top-ten
    sca:
      enabled: true
      severity: HIGH,CRITICAL
    dast:
      enabled: false
 
  full:
    sast:
      enabled: true
      config: [p/owasp-top-ten, p/security-audit]
    sca:
      enabled: true
      severity: ALL
    dast:
      enabled: true
      scan-type: full

#Target Definitions

yaml

# config/targets.yml
targets:
  production:
    url: https://app.example.com
    profile: full
    schedule: daily
 
  staging:
    url: https://staging.example.com
    profile: quick
    schedule: on-push
 
  api:
    url: https://api.example.com
    openapi: ./openapi.json
    profile: full
    schedule: weekly

#Coverage Metrics

#Security Coverage Calculation

python

# lib/reporting.py
def calculate_coverage(findings, requirements):
    """Calculate security test coverage."""
    covered = sum(1 for r in requirements if any(
        f['category'] == r['category'] for f in findings
    ))
    return covered / len(requirements) * 100
 
# Coverage per OWASP category
owasp_categories = [
    "A01", "A02", "A03", "A04", "A05",
    "A06", "A07", "A08", "A09", "A10"
]

#Dashboard Metrics

text

Security Dashboard:
├── Total findings: 42
├── Critical: 2 (5%)
├── High: 8 (19%)
├── Medium: 15 (36%)
├── Low: 17 (40%)
├── Coverage: 78% of OWASP Top 10
├── Trend: ↓ 12% from last month
└── Compliance: PCI DSS 85%

#Shared Libraries

#Utility Functions

python

# lib/utils.py
def validate_url(url):
    """Validate target URL format."""
    from urllib.parse import urlparse
    result = urlparse(url)
    return all([result.scheme, result.netloc])
 
def load_config(path):
    """Load YAML configuration."""
    import yaml
    with open(path) as f:
        return yaml.safe_load(f)

#Notification System

python

# lib/notifications.py
def send_slack_alert(findings, webhook_url):
    """Send critical findings to Slack."""
    critical = [f for f in findings if f['severity'] == 'critical']
    if critical:
        message = f"🚨 {len(critical)} critical findings detected"
        # Send to Slack webhook

Note

Framework harus modular — setiap scan type bisa di-enable/disable tanpa mengubah kode lain. Gunakan configuration-driven approach.

#Praktik: Build Framework

bash

# 1. Buat structure
mkdir -p security-test-framework/{config,tests,lib,reports,baselines}
 
# 2. Buat main entry point
cat > security-test-framework/security-tests.sh << 'EOF'
#!/bin/bash
set -e
PROFILE=${1:-quick}
echo "Running security tests with profile: $PROFILE"
# Load config and run scans based on profile
EOF
chmod +x security-test-framework/security-tests.sh
 
# 3. Test
./security-test-framework/security-tests.sh quick

#Penutup

Framework structure: config-driven, modular, reusable.
Scan profiles: quick/full/custom profiles untuk different use cases.
Coverage metrics: track security coverage per OWASP category.
Shared libraries: utilities, reporting, notifications.

Di episode 26 selanjutnya kita akan membahas ekosistem & tren modern 2026 — security testing terintegrasi CI/CD, AI-assisted testing, dan tren masa depan. Sampai jumpa di episode 26!