An Approach to Enhance CI/CD Pipeline with Open-Source Security Tools

Abstract

Continuous Integration (CI) and Continuous Deployment (CD) are important aspects in software engineering today. In modern software production organizational models, CI/CD pipeline has become a mandatory element to improve speed and reduce team effort in developing, integrating, and deploying. In the context of increasing information security risks, deploying security tools for the CI/CD pipeline has become an inevitable trend. Deploying information security tools throughout the pipeline according to the "Shift Left" philosophy will help detect information security issues early for timely handling and reduce correction costs. In this research, we present an approach to improve the CI/CD pipeline by integrating information security tools introduced by the Open Source Foundation for Application Security Project (OWASP). In addition, we also present trade-offs when implementing information security into the CI/CD pipeline.