DEVSECOPS-ПАЙПЛАЙН ДЛЯ ЗАБЕЗПЕЧЕННЯ БЕЗПЕКИ КЛІЄНТСЬКИХ ІНТЕРФЕЙСІВ СИСТЕМ IOT
TL;DR
The main contribution and scientific novelty of the results lie in creating an adaptive, easily integrated protection mechanism for the IoT ecosystem by integrating Static Application Security Testing (SAST) tools directly into the Gulp task runner architecture.
Abstract
This article examines the processes for ensuring the information security of client interfaces (Front-end) in Internet of Things (IoT) systems. This study aims to develop and implement an automated DevSecOps pipeline integrated into the Gulp build environment to detect and block code vulnerabilities at the earliest stages of development (the Shift Left concept). The tasks are as follows: 1) analyze technological opportunities and challenges of implementing DevSecOps for IoT web interfaces; 2) analyze possible threats and vulnerabilities inherent in client-side code; 3) analyze existing approaches to integrating SAST tools into automated workflows; 4) analyze options for using standard automation tools (such as Gulp) to solve security tasks; 5) propose a DevSecOps pipeline architecture for the security of client interfaces; 6) propose a sequence of critical components and experimentally verify the effectiveness of the proposed solution. Based on the set tasks, the following results were obtained. An analysis of security problems in modern JavaScript-based IoT interfaces was conducted, and the need for automated code control was substantiated. An architecture for a DevSecOps pipeline is proposed using Gulp.js as an automation tool and a configured ESLint as a SAST scanner. A Gulp plugin ("wrapper") has been developed and implemented, providing continuous code monitoring during development. The system successfully identifies dangerous patterns (e.g., the use of eval functions or vulnerable setTimeout constructions) and blocks such code from entering the final release (Artifact). The proposed approach does not create significant overhead on the development process but guarantees compliance with security policies. Conclusions. The main contribution and scientific novelty of the results lie in creating an adaptive, easily integrated protection mechanism for the IoT ecosystem by integrating Static Application Security Testing (SAST) tools directly into the Gulp task runner architecture. Applying DevSecOps practices at the build level minimizes human-factor risks and increases overall trust in smart device management systems. The proposed solution is scalable and can serve as a foundational element of a cybersecurity strategy for Internet of Things projects