How to Automate Security Testing for Your GraphQL Service

The workshop introduced three types of automated security testing for GraphQL services: Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST).

SCA works by examining the dependencies of your application to identify known vulnerabilities. Tools like Dependabot are used to alert developers about these vulnerabilities in the dependencies being used.

SAST analyzes your code to identify known security issues and vulnerabilities by looking for patterns and potential problems directly in your source code. It is useful for pointing out exact lines of code where issues may exist.

Unlike SAST, DAST involves testing an actively running version of your application. It scans the live application, identifying vulnerabilities that are present in the running instance, which might not be directly linked to the source code.

For implementing SAST, tools such as CodeQL and possibly Snyk were utilized. DAST was implemented using StackHawk, which integrates with various CI/CD pipelines and runs tests on the live application.

Security testing is integrated into the CI/CD pipeline by adding specific actions or steps that run security tests every time code is committed. This includes setting up GitHub actions for automated builds, and integrating tools like CodeQL and StackHawk for continuous security testing.

To set up security testing, you typically fork a vulnerable example repository into your own GitHub account, modify it by adding security testing tools in the CI/CD configuration, and then commit changes to test the setup.

Finding bugs early in the development cycle reduces the cost and time needed for fixes, minimizes disruptions, and improves the overall security and quality of the application before it reaches production.

StackHawk is used for dynamic application security testing. It scans live applications to identify real-time vulnerabilities and integrates with CI/CD pipelines to automate the testing process.

Integrating with tools like Snyk enhances security testing by correlating static analysis findings with dynamic testing results, providing a more comprehensive view of potential vulnerabilities in both the source code and the running application.