DevSecOps安全左移实践

约 2261 字大约 8 分钟

devsecopssecurity

2025-08-27

概述

DevSecOps 是将安全实践融入 DevOps 全生命周期的方法论。"安全左移"（Shift Left Security）的核心思想是将安全活动从传统的部署后检测前移到开发的早期阶段——越早发现安全问题，修复成本越低。据 IBM 研究，在设计阶段发现的安全缺陷修复成本仅为生产环境中的 1/100。

DevSecOps 全景

威胁建模

威胁建模是在设计阶段系统性地识别安全威胁和缺陷的过程。

STRIDE 模型

# 威胁建模文档模板
threat_model = {
    "system": "用户认证服务",
    "data_flow": [
        {"from": "用户浏览器", "to": "API 网关", "data": "登录凭证", "protocol": "HTTPS"},
        {"from": "API 网关", "to": "认证服务", "data": "凭证+请求上下文", "protocol": "gRPC/mTLS"},
        {"from": "认证服务", "to": "用户数据库", "data": "用户查询", "protocol": "TCP/TLS"},
    ],
    "threats": [
        {
            "id": "T-001",
            "category": "Spoofing",
            "description": "攻击者通过暴力破解获取用户凭证",
            "likelihood": "高",
            "impact": "高",
            "mitigation": [
                "实施速率限制（5次/分钟）",
                "启用 MFA",
                "使用 Argon2id 密码哈希",
                "账户锁定策略",
            ],
            "status": "已缓解",
        },
        {
            "id": "T-002",
            "category": "Information Disclosure",
            "description": "数据库凭证硬编码在源代码中",
            "likelihood": "中",
            "impact": "严重",
            "mitigation": [
                "使用 Vault 管理密钥",
                "配置 pre-commit 密钥检测",
            ],
            "status": "已缓解",
        },
    ],
    "trust_boundaries": [
        "互联网 <-> API 网关 (TLS 终止)",
        "API 网关 <-> 内部服务 (mTLS)",
        "服务 <-> 数据库 (加密连接)",
    ],
}

安全 SDLC

CI/CD 安全门禁

# GitHub Actions — 完整的安全 CI/CD Pipeline
name: Secure CI/CD Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  # 阶段 1: 密钥检测
  secret-detection:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 全量历史用于增量扫描

      - name: Gitleaks Secret Detection
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # 阶段 2: SAST 静态分析
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Semgrep SAST Scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/javascript
            p/typescript
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_TOKEN }}

  # 阶段 3: 依赖安全检查 (SCA)
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Trivy Dependency Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'

  # 阶段 4: 构建并扫描容器镜像
  container-security:
    needs: [secret-detection, sast, sca]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Trivy Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          severity: 'CRITICAL'
          exit-code: '1'

      - name: Sign Image with Cosign
        if: github.ref == 'refs/heads/main'
        uses: sigstore/cosign-installer@v3
        # cosign sign 步骤

  # 阶段 5: DAST 动态测试
  dast:
    needs: [container-security]
    runs-on: ubuntu-latest
    steps:
      - name: Start Application
        run: |
          docker run -d -p 8080:8080 myapp:${{ github.sha }}
          sleep 10  # 等待启动

      - name: OWASP ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.9.0
        with:
          target: 'http://localhost:8080'
          fail_action: 'warn'  # baseline 扫描警告级别

  # 阶段 6: IaC 安全扫描
  iac-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Trivy IaC Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: './infrastructure'
          severity: 'HIGH,CRITICAL'

  # 安全门禁：所有安全检查通过后才能部署
  deploy:
    needs: [container-security, dast, iac-security]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to Production
        run: echo "All security gates passed, deploying..."

SAST/DAST/SCA 集成策略

安全冠军（Security Champions）

安全冠军是各开发团队中对安全有兴趣和专长的成员，他们是安全团队和开发团队之间的桥梁。

Security as Code

# 安全策略即代码 — 使用 OPA (Open Policy Agent)

# policy/deployment.rego
package kubernetes.admission

# 禁止以 root 运行的容器
deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    container.securityContext.runAsUser == 0
    msg := sprintf("Container %v must not run as root", [container.name])
}

# 要求资源限制
deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    not container.resources.limits.memory
    msg := sprintf("Container %v must have memory limits", [container.name])
}

# 要求镜像来自可信仓库
deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    not startswith(container.image, "registry.example.com/")
    msg := sprintf("Image %v must be from trusted registry", [container.image])
}

# Terraform 安全策略（Sentinel）
# 要求 S3 存储桶启用加密
policy "s3-encryption" {
  enforcement_level = "hard-mandatory"
}

# sentinel/s3-encryption.sentinel
import "tfplan/v2" as tfplan

s3_buckets = filter tfplan.resource_changes as _, rc {
    rc.type is "aws_s3_bucket" and
    rc.change.actions contains "create"
}

encryption_enabled = rule {
    all s3_buckets as _, bucket {
        bucket.change.after.server_side_encryption_configuration is not null
    }
}

main = rule { encryption_enabled }

DevSecOps 成熟度模型

关键度量指标

# DevSecOps 关键指标
metrics = {
    # 漏洞修复时间
    "mttr_critical": "24 hours",      # Critical 漏洞平均修复时间
    "mttr_high": "7 days",            # High 漏洞平均修复时间

    # 扫描覆盖率
    "sast_coverage": "100%",           # SAST 覆盖的代码仓库百分比
    "sca_coverage": "100%",            # SCA 覆盖的项目百分比
    "container_scan_rate": "100%",     # 容器扫描覆盖率

    # 安全债务
    "open_vulnerabilities": {
        "critical": 0,                 # 目标：0
        "high": "< 10",               # 目标：少于 10
        "medium": "< 50",
    },

    # 安全文化
    "security_training_completion": "95%",  # 安全培训完成率
    "security_champions_ratio": "1:10",     # 安全冠军与开发者比例
    "threat_models_completed": "100%",      # 新项目威胁建模完成率
}

安全编码培训

# 安全编码培训主题清单
training_topics = [
    # 基础模块（所有开发者）
    "OWASP Top 10 Web 安全风险",
    "安全编码原则（输入验证、编码输出、最小权限）",
    "认证和会话管理最佳实践",
    "密钥管理（不硬编码密钥）",

    # 进阶模块（后端开发者）
    "SQL 注入与参数化查询",
    "API 安全设计",
    "加密原语的正确使用",

    # 前端模块（前端开发者）
    "XSS 防御与 CSP",
    "前端依赖安全",

    # 基础设施模块（DevOps/SRE）
    "容器安全加固",
    "Kubernetes 安全配置",
    "IaC 安全最佳实践",
]

完整的 DevSecOps 工具链

阶段	工具	用途
计划	OWASP Threat Dragon	威胁建模
编码	SonarLint, Snyk IDE	IDE 实时检测
Pre-commit	gitleaks, detect-secrets	密钥泄露检测
SAST	Semgrep, SonarQube, CodeQL	静态代码分析
SCA	Trivy, Snyk, Dependabot	依赖漏洞检查
构建	Cosign, SLSA	镜像签名/溯源
DAST	ZAP, Nuclei	动态应用测试
IaC	Trivy, Checkov, tfsec	基础设施扫描
运行时	Falco, Wazuh	运行时安全监控
监控	ELK, Splunk	SIEM/日志分析

最佳实践

从威胁建模开始，在设计阶段就识别安全风险
安全检查集成到 CI/CD，作为必须通过的门禁而非可选步骤
分阶段实施，先从密钥检测和 SCA 开始，逐步增加 SAST 和 DAST
建立安全冠军计划，让安全成为每个团队的责任
度量和可视化安全指标，用数据驱动安全改进
安全策略即代码，将安全规则版本化、可审计、可测试
定期安全培训，保持团队的安全意识和技能
建立快速反馈循环，开发者在 IDE 和 PR 阶段就能收到安全反馈

贡献者

withesse

更新日志

2026/3/14 13:09

查看所有更新日志

9f6c2-feat: organize wiki content and refresh site setup于 2026/3/14