CompTIA Security+ Preparation · lesson 27 of 45 · 25 min
Infrastructure as Code and DevSecOps
Infrastructure as Code (IaC) — managing infrastructure through code files rather than manual processes. Tools: Terraform (multi-cloud), Ansible (configuration management), CloudFormation (AWS), Puppet, Chef.
Security benefits of IaC: version-controlled infrastructure (audit trail), consistent deployments (no configuration drift), automated compliance checks, rapid remediation (redeploy from known-good state).
DevSecOps — integrating security into every phase of the DevOps pipeline (“shift left”). Security is everyone’s responsibility, not just the security team’s.
CI/CD pipeline — Continuous Integration/Continuous Deployment. Code is automatically built, tested, and deployed. Security gates are inserted at each stage.
Pipeline security stages: Code commit → SAST → Build → DAST → Staging → Security review → Production.
Application Security Testing
SAST (Static Application Security Testing) — analyzes source code without executing it. Finds vulnerabilities early in development. “White box” testing. Tools: SonarQube, Checkmarx, Veracode. Fast, catches issues before deployment.
DAST (Dynamic Application Security Testing) — tests running applications by sending malicious inputs. “Black box” testing. Finds runtime vulnerabilities. Tools: OWASP ZAP, Burp Suite. Requires a running application.
IAST (Interactive AST) — combines SAST and DAST. Instruments the running application to monitor behavior during testing.
SCA (Software Composition Analysis) — identifies vulnerabilities in third-party libraries and open-source components. Critical because most modern apps are 80%+ open-source code.
Container security — scanning container images for vulnerabilities, using minimal base images, running as non-root, immutable containers, image signing.
Shift Left Security
“Shift left” means moving security earlier in the development lifecycle. Finding a vulnerability in code review costs ~$100 to fix. Finding it in production costs ~$10,000. SAST and SCA enable shift-left security.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — IaC & Secure DevOps
SAST analyzes:
- Running applications
- Source code without executing it
- Network traffic
- Container images only
- Answer: Source code without executing it
SAST is static analysis — it reads the code directly, finding vulnerabilities before the application is even built. DAST requires:
- Access to source code
- A running application to test
- A compiled binary only
- Network packet captures
- Answer: A running application to test
DAST tests the application dynamically — it sends inputs and observes responses, requiring a running instance. “Shift left” security means:
- Moving security to the end of development
- Moving security earlier in the development lifecycle
- Shifting security to the left side of the network
- Reducing security controls
- Answer: Moving security earlier in the development lifecycle
Shift left: find and fix vulnerabilities during development (cheap) rather than in production (expensive). SCA is used to find vulnerabilities in:
- Custom application code
- Third-party libraries and open-source components
- Network configurations
- Database schemas
- Answer: Third-party libraries and open-source components
SCA scans dependencies — critical because most apps use hundreds of open-source libraries, each potentially containing known CVEs. Terraform is used for:
- Application security testing
- Infrastructure as Code — provisioning cloud resources
- Container scanning
- Password management
- Answer: Infrastructure as Code — provisioning cloud resources
Terraform provisions and manages cloud infrastructure through code — supports AWS, Azure, GCP, and many other providers. A key security benefit of IaC is:
- Faster network speeds
- Version-controlled, auditable, consistent infrastructure deployments
- Automatic vulnerability patching
- Reduced cloud costs
- Answer: Version-controlled, auditable, consistent infrastructure deployments
IaC provides an audit trail of all infrastructure changes, prevents configuration drift, and enables rapid rollback. DevSecOps integrates security:
- Only at the end of development
- Only during penetration testing
- Into every phase of the DevOps pipeline
- Only in production
- Answer: Into every phase of the DevOps pipeline
DevSecOps: security is built into every stage — code review, build, test, deploy — not bolted on at the end. Container security best practices include:
- Running containers as root for simplicity
- Using minimal base images and running as non-root
- Disabling image scanning
- Using the same image for all environments
- Answer: Using minimal base images and running as non-root
Minimal images reduce attack surface; non-root containers limit damage if compromised; image scanning catches known CVEs.
IAST combines elements of both SAST and DAST.
- True
- False
Answer: True
IAST instruments the running application — it has visibility into source code (like SAST) while testing dynamically (like DAST).
In a CI/CD pipeline, security gates are inserted:
- Only before production deployment
- At each stage of the pipeline
- Only during code review
- Only in the testing environment
- Answer: At each stage of the pipeline
Security gates throughout the pipeline: SAST at commit, SCA at build, DAST at staging — catching issues as early as possible.
Previous lesson: Resilience and redundancy: HA, clustering, RAID, backups, BCP/DRP
Back to CompTIA Security+ Preparation
Next lesson: Identity and access management: MFA, SSO, PAM, directory services