DevSecOps 완전 가이드 2025: Shift-Left 보안, SAST/DAST/SCA, 컨테이너 보안까지

┌─────────────────────────────────────────────────────────────┐
│                    DevSecOps 파이프라인                        │
├──────────┬──────────┬──────────┬──────────┬────────────────┤
│   Plan   │  Code    │  Build   │  Test    │  Deploy/Run    │
├──────────┼──────────┼──────────┼──────────┼────────────────┤
│ Threat   │ SAST     │ SCA      │ DAST     │ Runtime        │
│ Modeling │ Semgrep  │ Snyk     │ ZAP      │ Protection     │
│          │ CodeQL   │ Trivy    │ Burp     │ Falco          │
│ Security │ SonarQube│ OSV      │ Nuclei   │ Container      │
│ Require  │          │          │          │ Security       │
│ ments    │ Secret   │ SBOM     │ Fuzzing  │ Network        │
│          │ Detect   │ Signing  │          │ Policy         │
├──────────┼──────────┼──────────┼──────────┼────────────────┤
│     Policy-as-Code (OPA / Kyverno / Conftest)              │
└─────────────────────────────────────────────────────────────┘

전통적 방식:
Plan → Code → Build → Test → Deploy → [보안 검토] → Release
                                         ↑ 여기서 발견 = 비용 높음

Shift-Left 방식:
Plan → [보안] → Code → [보안] → Build → [보안] → Test → Deploy
  ↑ 여기서 시작 = 비용 낮음

# security-champions.yaml
teams:
  - name: "Backend Team"
    champion: "alice@company.com"
    responsibilities:
      - "PR 보안 리뷰"
      - "SAST 결과 트리아지"
      - "월간 보안 교육 진행"
    training:
      - "OWASP Top 10"
      - "Secure Coding Practices"
      - "Threat Modeling 기초"
  - name: "Frontend Team"
    champion: "bob@company.com"
    responsibilities:
      - "XSS/CSRF 방지 검토"
      - "의존성 취약점 관리"
      - "CSP 헤더 관리"

STRIDE 위협 모델:
┌─────────────────────────────────────────┐
│ S - Spoofing (위장)                      │
│ T - Tampering (변조)                     │
│ R - Repudiation (부인)                   │
│ I - Information Disclosure (정보 노출)    │
│ D - Denial of Service (서비스 거부)       │
│ E - Elevation of Privilege (권한 상승)    │
└─────────────────────────────────────────┘

// .vscode/settings.json
{
  "semgrep.scan.autoScan": true,
  "semgrep.scan.configuration": [
    "p/owasp-top-ten",
    "p/typescript",
    "p/react"
  ],
  "sonarlint.connectedMode.project": {
    "connectionId": "my-sonarqube",
    "projectKey": "my-project"
  }
}

# docker-compose.yml - SonarQube 로컬 설정
version: "3.8"
services:
  sonarqube:
    image: sonarqube:community
    ports:
      - "9000:9000"
    environment:
      SONAR_JDBC_URL: jdbc:postgresql://db:5432/sonarqube
      SONAR_JDBC_USERNAME: sonar
      SONAR_JDBC_PASSWORD: sonar
    volumes:
      - sonar_data:/opt/sonarqube/data
      - sonar_logs:/opt/sonarqube/logs
      - sonar_extensions:/opt/sonarqube/extensions
    depends_on:
      - db
  db:
    image: postgres:15
    environment:
      POSTGRES_DB: sonarqube
      POSTGRES_USER: sonar
      POSTGRES_PASSWORD: sonar
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  sonar_data:
  sonar_logs:
  sonar_extensions:
  postgres_data:

# sonar-project.properties
sonar.projectKey=my-app
sonar.projectName=My Application
sonar.projectVersion=1.0
sonar.sources=src
sonar.tests=tests
sonar.language=ts
sonar.sourceEncoding=UTF-8
sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.qualitygate.wait=true

# .semgrep.yml - 커스텀 보안 룰
rules:
  - id: no-eval-usage
    patterns:
      - pattern: eval(...)
    message: "eval() 사용은 코드 인젝션 위험이 있습니다"
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      owasp: "A03:2021 Injection"
      cwe: "CWE-95"

  - id: no-innerHTML
    patterns:
      - pattern: $EL.innerHTML = $VAL
    message: "innerHTML 직접 설정은 XSS 위험이 있습니다. textContent 또는 DOMPurify를 사용하세요"
    severity: WARNING
    languages: [javascript, typescript]

  - id: sql-injection-risk
    patterns:
      - pattern: |
          $DB.query(`... ${$VAR} ...`)
      - pattern: |
          $DB.query("..." + $VAR + "...")
    message: "SQL 인젝션 위험! 파라미터 바인딩을 사용하세요"
    severity: ERROR
    languages: [javascript, typescript]
    fix: |
      $DB.query("... $1 ...", [$VAR])

  - id: no-hardcoded-secrets
    patterns:
      - pattern: |
          const $KEY = "AKIA..."
      - pattern: |
          const $KEY = "sk-..."
    message: "하드코딩된 시크릿이 발견되었습니다. 환경 변수를 사용하세요"
    severity: ERROR
    languages: [javascript, typescript]

# Semgrep 실행
semgrep --config auto --config .semgrep.yml src/

# 특정 룰셋만 실행
semgrep --config p/owasp-top-ten src/
semgrep --config p/typescript src/
semgrep --config p/react src/

# CI용 JSON 출력
semgrep --config auto --json --output results.json src/

// codeql-queries/sql-injection.ql
/**
 * @name SQL injection in query string
 * @description 사용자 입력이 SQL 쿼리에 직접 포함됨
 * @kind path-problem
 * @problem.severity error
 * @security-severity 9.8
 * @precision high
 * @id js/sql-injection
 * @tags security
 *       external/cwe/cwe-089
 */

import javascript
import DataFlow::PathGraph

class SqlInjectionConfig extends TaintTracking::Configuration {
  SqlInjectionConfig() { this = "SqlInjectionConfig" }

  override predicate isSource(DataFlow::Node source) {
    exists(Express::RequestInputAccess input |
      source = input
    )
  }

  override predicate isSink(DataFlow::Node sink) {
    exists(DatabaseAccess query |
      sink = query.getAQueryArgument()
    )
  }
}

from SqlInjectionConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink,
  "이 쿼리는 $@에서 받은 사용자 입력을 포함합니다.",
  source.getNode(), "사용자 입력"

# zap-automation.yaml
env:
  contexts:
    - name: "My Web App"
      urls:
        - "https://staging.example.com"
      includePaths:
        - "https://staging.example.com/.*"
      excludePaths:
        - "https://staging.example.com/logout"
      authentication:
        method: "form"
        parameters:
          loginUrl: "https://staging.example.com/login"
          loginRequestData: "username=test&password=test123"

jobs:
  - type: spider
    parameters:
      context: "My Web App"
      maxDuration: 5
      maxDepth: 10

  - type: spiderAjax
    parameters:
      context: "My Web App"
      maxDuration: 5

  - type: passiveScan-wait
    parameters:
      maxDuration: 10

  - type: activeScan
    parameters:
      context: "My Web App"
      maxRuleDurationInMins: 5
      policy: "API-Scan"

  - type: report
    parameters:
      template: "modern"
      reportDir: "/zap/reports"
      reportFile: "zap-report"
      reportTitle: "ZAP Security Report"
    risks:
      - high
      - medium
      - low

# Docker로 ZAP 자동화 스캔 실행
docker run --rm -v $(pwd):/zap/wrk:rw \
  -t zaproxy/zap-stable \
  zap.sh -cmd -autorun /zap/wrk/zap-automation.yaml

# API 스캔 (OpenAPI 스펙 기반)
docker run --rm -v $(pwd):/zap/wrk:rw \
  -t zaproxy/zap-stable \
  zap-api-scan.py \
    -t https://staging.example.com/openapi.json \
    -f openapi \
    -r api-report.html

# .snyk - Snyk 정책 파일
version: v1.5
ignore:
  SNYK-JS-LODASH-590103:
    - '*':
        reason: "해당 함수를 사용하지 않음"
        expires: "2026-06-01T00:00:00.000Z"
patch: {}

language-settings:
  javascript:
    severity-threshold: high

# Snyk CLI 사용법
snyk test                    # 취약점 검사
snyk monitor                 # 지속적 모니터링 등록
snyk test --severity-threshold=high  # 높은 심각도만
snyk code test               # SAST 스캔
snyk container test myimage:latest  # 컨테이너 스캔
snyk iac test terraform/     # IaC 스캔

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "Asia/Seoul"
    open-pull-requests-limit: 10
    reviewers:
      - "security-team"
    labels:
      - "dependencies"
      - "security"
    commit-message:
      prefix: "deps"
      include: "scope"
    # 보안 업데이트는 자동 머지
    groups:
      security-patches:
        patterns:
          - "*"
        update-types:
          - "security"

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "docker"
      - "dependencies"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "ci"
      - "dependencies"

// renovate.json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base",
    ":semanticCommits",
    "group:allNonMajor",
    "schedule:weekends"
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"],
    "schedule": ["at any time"]
  },
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
    },
    {
      "matchPackagePatterns": ["eslint", "prettier"],
      "groupName": "linting tools",
      "automerge": true
    },
    {
      "matchPackagePatterns": ["^@types/"],
      "groupName": "type definitions",
      "automerge": true
    }
  ],
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2
}

# 기본 이미지 스캔
trivy image myapp:latest

# 심각도 필터링
trivy image --severity CRITICAL,HIGH myapp:latest

# 수정 가능한 취약점만
trivy image --ignore-unfixed myapp:latest

# SBOM 생성
trivy image --format cyclonedx --output sbom.json myapp:latest

# CI용 JSON 출력과 종료 코드
trivy image --format json --output results.json \
  --exit-code 1 --severity CRITICAL myapp:latest

# 파일시스템 스캔 (빌드 전)
trivy fs --security-checks vuln,secret,config .

# Kubernetes 매니페스트 스캔
trivy config k8s/

# BAD - 보안 안티패턴
FROM ubuntu:latest
RUN apt-get update && apt-get install -y python3
COPY . /app
RUN pip install -r requirements.txt
USER root
EXPOSE 8080
CMD ["python3", "app.py"]

# GOOD - 보안 모범 사례
# 1. 최소 베이스 이미지 사용
FROM python:3.12-slim AS builder

# 2. 패키지 설치 후 캐시 정리
RUN apt-get update && \
    apt-get install -y --no-install-recommends gcc && \
    rm -rf /var/lib/apt/lists/*

# 3. 별도 빌드 스테이지
WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# 4. 최종 이미지는 최소화
FROM python:3.12-slim

# 5. 비루트 사용자
RUN groupadd -r appuser && useradd -r -g appuser appuser

# 6. 빌드 아티팩트만 복사
COPY --from=builder /install /usr/local
COPY --chown=appuser:appuser . /app

WORKDIR /app
USER appuser

# 7. 읽기 전용 파일시스템 지원
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s \
  CMD curl -f http://localhost:8080/health || exit 1

CMD ["python3", "app.py"]

# Grype - 이미지 취약점 스캔
grype myapp:latest
grype myapp:latest --only-fixed
grype myapp:latest -o json > grype-results.json

# Docker Scout - Docker Desktop 통합
docker scout cves myapp:latest
docker scout recommendations myapp:latest
docker scout quickview myapp:latest

컨테이너 보안 체크리스트:

이미지 빌드:
  [x] 최소 베이스 이미지 (distroless, alpine, slim)
  [x] 멀티스테이지 빌드
  [x] 비루트 사용자 실행
  [x] 불필요한 패키지 제거
  [x] .dockerignore 설정
  [x] 이미지 서명 (cosign)

런타임:
  [x] 읽기 전용 파일시스템
  [x] 리소스 제한 (CPU, 메모리)
  [x] capabilities 최소화
  [x] seccomp/AppArmor 프로파일
  [x] 네트워크 정책 적용

레지스트리:
  [x] 프라이빗 레지스트리 사용
  [x] 이미지 취약점 스캔
  [x] 태그 불변성 설정
  [x] 이미지 서명 검증

# .gitleaks.toml
title = "Custom Gitleaks Configuration"

[extend]
useDefault = true

[[rules]]
id = "custom-api-key"
description = "Custom API Key Pattern"
regex = '''(?i)api[_-]?key\s*[:=]\s*['"][a-zA-Z0-9]{32,}['"]'''
entropy = 3.5
secretGroup = 0
tags = ["api", "key"]

[[rules]]
id = "private-key-file"
description = "Private Key File Reference"
regex = '''(?i)(private[_-]?key|ssh[_-]?key)\s*[:=]\s*['"].*\.(pem|key|p12)['"]'''
tags = ["key", "private"]

[allowlist]
description = "Global Allowlist"
paths = [
  '''\.gitleaks\.toml''',
  '''test/.*''',
  '''.*_test\.go''',
  '''.*\.test\.(ts|js)'''
]
regexes = [
  '''EXAMPLE_.*''',
  '''REPLACE_ME'''
]

# GitLeaks 실행
gitleaks detect --source . --verbose
gitleaks detect --source . --report-format json --report-path leaks.json

# Git 히스토리 전체 스캔
gitleaks detect --source . --log-opts="--all"

# pre-commit hook
gitleaks protect --staged --verbose

# 리포지토리 전체 스캔
trufflehog git file://. --only-verified

# GitHub 조직 전체 스캔
trufflehog github --org=my-org --only-verified

# Docker 이미지 스캔
trufflehog docker --image=myapp:latest

# S3 버킷 스캔
trufflehog s3 --bucket=my-bucket

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: detect-private-key
      - id: check-added-large-files
        args: ['--maxkb=500']

  - repo: https://github.com/returntocorp/semgrep
    rev: v1.50.0
    hooks:
      - id: semgrep
        args: ['--config', 'p/secrets', '--error']

# CycloneDX 포맷 SBOM 생성
# npm 프로젝트
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

# Python 프로젝트
cyclonedx-py requirements requirements.txt -o sbom.json

# 컨테이너 이미지
trivy image --format cyclonedx -o sbom.json myapp:latest
syft myapp:latest -o cyclonedx-json > sbom.json

# SPDX 포맷
syft myapp:latest -o spdx-json > sbom-spdx.json

// SBOM 예시 (CycloneDX 간략)
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "metadata": {
    "component": {
      "type": "application",
      "name": "my-web-app",
      "version": "2.1.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.18.2",
      "purl": "pkg:npm/express@4.18.2",
      "licenses": [{ "license": { "id": "MIT" } }]
    },
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21"
    }
  ]
}

SLSA 레벨:
┌──────────────┬─────────────────────────────────────┐
│ SLSA Level 0 │ 보안 보장 없음                        │
│ SLSA Level 1 │ 빌드 프로세스 문서화 (provenance)      │
│ SLSA Level 2 │ 호스팅된 빌드, 서명된 provenance       │
│ SLSA Level 3 │ 격리된 빌드, 변조 방지                 │
└──────────────┴─────────────────────────────────────┘

# cosign으로 컨테이너 이미지 서명
cosign sign --key cosign.key myregistry/myapp:v1.0.0

# 키리스 서명 (OIDC 기반)
cosign sign myregistry/myapp:v1.0.0

# 서명 검증
cosign verify --key cosign.pub myregistry/myapp:v1.0.0

# SBOM 첨부
cosign attach sbom --sbom sbom.json myregistry/myapp:v1.0.0

# 아티팩트 증명 (attestation) 생성
cosign attest --predicate provenance.json \
  --type slsaprovenance \
  myregistry/myapp:v1.0.0

# policy/kubernetes.rego
package kubernetes.admission

# 루트 컨테이너 금지
deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  container.securityContext.runAsUser == 0
  msg := sprintf("컨테이너 '%s'가 root로 실행됩니다", [container.name])
}

# 최신 태그 금지
deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  endswith(container.image, ":latest")
  msg := sprintf("컨테이너 '%s'가 latest 태그를 사용합니다", [container.name])
}

# 리소스 제한 필수
deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  not container.resources.limits
  msg := sprintf("컨테이너 '%s'에 리소스 제한이 없습니다", [container.name])
}

# 읽기 전용 루트 파일시스템 필수
deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  not container.securityContext.readOnlyRootFilesystem
  msg := sprintf("컨테이너 '%s'가 읽기 전용 파일시스템을 사용하지 않습니다", [container.name])
}

# kyverno-policies.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-team-label
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "모든 Pod에는 'team' 라벨이 필요합니다"
        pattern:
          metadata:
            labels:
              team: "?*"

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged
spec:
  validationFailureAction: Enforce
  rules:
    - name: no-privileged-containers
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Privileged 컨테이너는 허용되지 않습니다"
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: "false"

# Conftest로 Terraform 검증
conftest test terraform/ --policy policy/

# Dockerfile 검증
conftest test Dockerfile --policy policy/docker/

# Kubernetes 매니페스트 검증
conftest test k8s/ --policy policy/kubernetes/

# policy/docker/dockerfile.rego
package main

deny[msg] {
  input[i].Cmd == "from"
  val := input[i].Value
  contains(val[0], ":latest")
  msg := "FROM에 latest 태그 사용 금지"
}

deny[msg] {
  input[i].Cmd == "user"
  val := input[i].Value
  val[0] == "root"
  msg := "USER root 사용 금지"
}

# .github/workflows/security.yml
name: Security Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # 매주 월요일 오전 6시

permissions:
  contents: read
  security-events: write
  pull-requests: write

jobs:
  # 1단계: Secret 탐지
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: GitLeaks Scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # 2단계: SAST
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Semgrep Scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/typescript
            p/react
          generateSarif: "1"

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif
        if: always()

  # 3단계: SCA (의존성 스캔)
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Snyk Security Scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  # 4단계: 컨테이너 보안
  container-security:
    runs-on: ubuntu-latest
    needs: [sast]
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker Image
        run: docker build -t myapp:test .

      - name: Trivy Image Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:test'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      - name: Upload Trivy SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
        if: always()

  # 5단계: SBOM 생성
  sbom:
    runs-on: ubuntu-latest
    needs: [container-security]
    steps:
      - uses: actions/checkout@v4

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: myapp:test
          format: cyclonedx-json
          output-file: sbom.json

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

  # 6단계: IaC 스캔
  iac-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Trivy IaC Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-iac.sarif'

      - name: Upload IaC SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-iac.sarif'
        if: always()

  # 7단계: DAST (스테이징 배포 후)
  dast:
    runs-on: ubuntu-latest
    needs: [container-security]
    if: github.ref == 'refs/heads/main'
    steps:
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.10.0
        with:
          target: 'https://staging.example.com'
          rules_file_name: '.zap-rules.tsv'
          fail_action: 'warn'

  # 최종: 보안 게이트
  security-gate:
    runs-on: ubuntu-latest
    needs: [secret-scan, sast, sca, container-security, iac-security]
    steps:
      - name: Security Gate Check
        run: |
          echo "All security checks passed!"
          echo "Pipeline completed at $(date)"

# .github/workflows/codeql.yml
name: CodeQL Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 4 * * 1'

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      matrix:
        language: ['javascript', 'typescript']
    steps:
      - uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: +security-extended,security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"