보안 스캐닝

컨테이너, 코드, 인프라의 보안 취약점을 지속적으로 검사

컨테이너, 코드, 인프라의 보안 취약점을 지속적으로 검사

목표: DevSecOps 파이프라인에서 보안을 자동화할 수 있는 수준

🛡️ DevSecOps 개요

보안 스캐닝 파이프라인

graph LR
    CODE["💻 Source Code"] -->|"SAST"| SAST["🔍 정적 분석"]
    DEPS["📦 Dependencies"] -->|"SCA"| SCA["📚 구성 요소 분석"]
    IMAGE["🐳 Container Image"] -->|"Container Scan"| CONTAINER["🔍 컨테이너 스캔"]
    INFRA["🏗️ Infrastructure"] -->|"IaC Scan"| IAC["🔍 IaC 스캔"]
    
    SAST -->|"결과"| REPORT["📊 보고서"]
    SCA -->|"결과"| REPORT
    CONTAINER -->|"결과"| REPORT
    IAC -->|"결과"| REPORT

🔍 컨테이너 스캐닝

Trivy

# 설치
brew install aquasecurity/trivy/trivy

# 이미지 스캔
trivy image nginx:latest

# 심각도 필터
trivy image --severity HIGH,CRITICAL nginx:latest

# JSON 출력
trivy image --format json -o report.json nginx:latest

# 파일 시스템 스캔
trivy fs --security-checks vuln,config,secret .

# Git 저장소 스캔
trivy repo https://github.com/myorg/myapp

# Kubernetes 스캔
trivy k8s --report summary cluster

CI/CD 통합

# .github/workflows/security.yml
name: Security Scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

📚 의존성 스캐닝

Snyk

# 설치
npm install -g snyk

# 로그인
snyk auth

# 의존성 스캔
snyk test

# 모니터링 등록
snyk monitor

# Docker 이미지 스캔
snyk container test myapp:latest

# IaC 스캔
snyk iac test terraform/

GitHub Dependabot

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 10
    
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    
  - package-ecosystem: "terraform"
    directory: "/"
    schedule:
      interval: "weekly"

🔐 코드 스캐닝

SonarQube

# sonar-project.properties
sonar.projectKey=myapp
sonar.sources=src
sonar.tests=tests
sonar.javascript.lcov.reportPaths=coverage/lcov.info
sonar.coverage.exclusions=**/*.test.js

# .github/workflows/sonar.yml
name: SonarQube Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  sonar:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: SonarQube Scan
        uses: sonarqube-quality-gate-action@master
        with:
          scanMetadataReportFile: .scannerwork/report-task.txt
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

GitHub CodeQL

# .github/workflows/codeql.yml
name: CodeQL Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 0 * * 0'

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ['javascript', 'python']

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ matrix.language }}

      - name: Autobuild
        uses: github/codeql-action/autobuild@v2

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

🏗️ IaC 스캐닝

Checkov

# 설치
pip install checkov

# Terraform 스캔
checkov -d terraform/

# Kubernetes 스캔
checkov -d k8s/

# Docker 스캔
checkov -f Dockerfile

# 특정 규칙만 실행
checkov -d terraform/ --check CKV_AWS_1,CKV_AWS_2

# 규칙 제외
checkov -d terraform/ --skip-check CKV_AWS_1

tfsec

# 설치
brew install tfsec

# Terraform 스캔
tfsec terraform/

# 포맷 지정
tfsec -f json terraform/

# 심각도 필터
tfsec --minimum-severity HIGH terraform/

📋 보안 체크리스트

🔗 관련 노트

02-04-NetworkPolicy — 네트워크 보안
02-10-ServiceAccount — Kubernetes 보안
01-03-도커-기본 — Docker 보안

마지막 업데이트: 2026-06-01