Hands-on exercise – Integrating security within the build and test phases
In this exercise, we will be integrating security within the build and test phases of our pipeline. We will practically implement artifact signing for integrity and implement DAST using ZAP.
The following are the tasks for this exercise:
- Task 1 – Implementing artifact signing for integrity checks
- Task 2 – Integrating DAST tools to find and fix security vulnerabilities in the test phase
Prerequisites
Before diving into the first task, let’s first create a key vault in Azure Key Vault then generate a self-signed key and certificate. This is what we will use later to sign the image with Notation.
- Navigate to your Azure portal at https://portal.azure.com.
- Search for
key vaultsin the search bar and select Key vaults.
Figure 7.36 – Search and select Key vaults
- Click on Create and fill in the required details...
