FILE: materi-28.module

DevSecOps - Security Integration

Shift left security. Security di setiap tahap CI/CD, bukan after-thought.

RUNTIME: 26m LEVEL: advanced STATUS: ACTIVE
> DEVSECOPS $ Security shift left [OK] Module loaded successfully [INFO] Ready for next stage

1. Shift Left Security

Tradisional: security review di akhir, lambat dan mahal kalau bug ditemukan. Shift left: security di setiap tahap. Dev tahu security risk dari awal. Cheaper dan faster.

2. Tools di Pipeline

SAST (Static Application Security Testing): SonarQube, Semgrep. DAST (Dynamic): OWASP ZAP. SCA (Software Composition Analysis): Snyk, Dependabot. Container scan: Trivy. Secret scan: GitGuardian.

3. Compliance as Code

Security policy dalam code, bukan dokumen. Open Policy Agent (OPA). InSpec. Setiap deploy auto check compliance. Catat: SOC 2, PCI DSS auditor seneng.

4. Threat Modeling Continuous

Bukan 1 kali saat design. Setiap fitur baru, threat model singkat. Tools: OWASP Threat Dragon. Integrate dengan ticket system.

5. Security Champions

Tidak semua dev jadi security expert. Identify dan train champion di setiap team. Bridge ke security team. Multiplier security culture organization wide.

Practical Mission

  1. Add Snyk ke repo GitHub
  2. Setup SonarQube cloud
  3. Run OWASP ZAP di staging
  4. Pelajari OPA Rego
  5. Identifikasi security champion di team

Recap Module