Integrating DAST in Kanban and CI/CD: A Real World Security Case Study
This action research case study examines the challenges and best practices of integrating Dynamic Application Security Testing (DAST) into Kanban workflows and CI/CD pipelines, offering developer-centric insights on balancing security rigor with the speed of modern Agile software delivery.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are running a busy, high-speed restaurant kitchen. Your goal is to serve delicious meals to customers as fast as possible. You use a system called Kanban, where orders (tasks) move across a board from "To Do" to "Cooking" to "Served." You want to keep the line moving, never letting the kitchen get clogged up.
Now, imagine you realize that sometimes, the food might be spoiled, or a chef might accidentally leave a knife on the counter. In the past, you might have stopped the whole kitchen once a month to do a massive, slow safety inspection. But in a fast-paced kitchen, stopping everything isn't an option. You need a way to check for safety while the food is being cooked, without slowing down the service.
This is exactly what the paper "Integrating DAST in Kanban and CI/CD" is about. It's a real-life story about a team of software developers (our "chefs") trying to add a Dynamic Application Security Testing (DAST) tool to their fast-moving workflow.
Here is the breakdown of their journey, using simple analogies:
1. The Problem: Speed vs. Safety
The team was building a digital "Identity Service" (like a master key system for a huge office building). They were moving fast using Kanban (moving tasks across a board) and CI/CD (an automated assembly line that builds and ships software instantly).
- The Conflict: Traditional security checks are like a slow, heavy inspection truck that blocks the road. It requires long planning and paperwork. This clashes with the "move fast and break things" vibe of modern software.
- The Goal: They wanted to install a "security robot" (DAST) that could sneak into their finished software, try to break it (like a hacker would), and report back, all without stopping the assembly line.
2. The Experiment: Trying Different Tools
The team tried to build this security robot themselves.
- Attempt 1 (The Free Tool): They tried a free, open-source tool called ZAP.
- The Analogy: Imagine trying to use a bicycle to deliver a heavy package. It works for small, simple tasks, but when the package got heavy (complex JavaScript websites) or the road changed (new internet protocols), the bike fell apart. It couldn't handle the modern, dynamic parts of their website.
- Attempt 2 (The Pro Tool): They switched to Burp Suite, a paid, professional tool.
- The Analogy: They upgraded to a delivery truck. This tool could handle the heavy, complex websites and navigate the new roads perfectly. It worked!
3. The Reality Check: What Happened Next?
Once the truck was on the road, the team interviewed everyone to see how it felt. Here is what they found:
A. Willingness: Everyone Wanted to Try, But...
- The Good: Almost everyone was excited. They realized, "Hey, having a security robot is better than hoping nothing breaks!" It gave them peace of mind.
- The Bad: Some people were worried about the cost (money and time). One person said, "I'm willing, but only if we don't have to do all the work ourselves."
B. The "One-Person Show" (The Hidden Trap)
This is the most important lesson from the paper.
- The Situation: The security robot worked great, but only one engineer actually knew how to drive it. He did all the setup, ran the scans, and read the reports.
- The Result: The rest of the team (the chefs) barely noticed the robot was there. They didn't have to stop cooking. Their speed (velocity) didn't slow down.
- The Risk: If that one engineer gets sick or quits, the whole security system stops. The team became dependent on a single "security wizard" rather than making security a habit for everyone.
C. The "Quarterly" Compromise
Ideally, a security robot should check the food every time a new dish is made. But the team decided to only run the robot once every three months (quarterly).
- Why? They were afraid that running it too often would clog the kitchen.
- The Lesson: They prioritized speed over constant security. They decided to only fix the "big, scary" problems and ignore the small ones to keep moving fast.
D. The Report Confusion
When the robot found a problem, it printed a long, confusing report full of technical jargon.
- The Analogy: The robot said, "Error 404: The sauce is too salty," but the chefs just saw a wall of text they didn't understand. They didn't know how to fix it.
- The Fix: They realized they needed the robot to speak "human" and tell them exactly what to do, not just list errors.
4. The Big Takeaways (Lessons Learned)
If you want to add security to a fast-moving team, here is the "cheat sheet" from the paper:
- Automate Everything: Don't make humans do the boring security checks. Let the robot do it so the humans can focus on cooking.
- Don't Rely on One Person: If only one person knows how to use the security tool, you are in trouble. You need to train the whole team or have a dedicated security specialist who helps everyone, not just one person doing all the work.
- Make Reports Simple: If the security tool speaks in a foreign language, no one will listen. The reports need to be clear, simple, and actionable.
- Change the Culture: Right now, the team thinks, "Get the job done, then worry about safety later." They need to shift to "Safety is part of the job." It's like wearing a seatbelt; you don't stop the car to put it on, you just do it automatically.
- Layer Your Defenses: DAST is great, but it's not perfect. It's like having a lock on your door. You still need a guard dog (other security tools) and a fence (firewalls). Use a mix of tools.
Summary
The paper tells us that adding security to fast software development is possible, but it's tricky. You can't just throw a heavy security tool at a fast team and expect it to work. You need the right tools (like the professional truck), you need to automate the process so it doesn't slow you down, and you need to teach everyone how to use it so it doesn't depend on just one person.
The team succeeded in adding security, but they learned that speed and security can coexist only if you build the right systems and change the mindset of the whole team.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.