Loading...
Publication
Cibersegurança: Integração de SSDLC em ambiente de confiança zero e migração para a nuvem
| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 6.59 MB | Adobe PDF |
Authors
Advisor(s)
Abstract(s)
Este documento apresenta os principais resultados da investigação desenvolvida no âmbito da
Dissertação do Mestrado em Engenharia Informática do Instituto Superior de Engenharia do
Porto (ISEP), centrada na integração de práticas de desenvolvimento seguro de software (SSDLC)
e na migração de aplicações on-premise para a plataforma Microsoft Azure, com foco no serviço
Azure Container Apps.
O principal objetivo foi identificar e implementar ferramentas de apoio ao ciclo de vida do
desenvolvimento seguro, como análise estática de código, análise de dependências e deteção
de vulnerabilidades, bem como avaliar a viabilidade técnica e organizacional da migração de
aplicações existentes para a nuvem, num contexto empresarial com políticas de segurança
baseadas em confiança zero.
Através da integração prática de ferramentas como Teamscale, OWASP Dependency-Check e
Snyk, bem como da automatização de pipelines no Azure DevOps, foi possível melhorar
significativamente os processos de desenvolvimento e entrega contínua, assegurando a
deteção precoce de problemas de qualidade e segurança.
Adicionalmente, a migração bem-sucedida para Azure Container Apps permitiu modernizar a
infraestrutura e simplificar operações como monitorização e as atualizações de versões em
ambiente produtivo.
Este estudo contribui não só para a melhoria da eficiência interna da equipa, como também
para a literatura prática sobre DevSecOps e migração para a nuvem, podendo servir como
referência para outras equipas dentro da organização ou até mesmo para outras empresas em
contextos semelhantes.
This document presents the main findings of the research conducted as part of the Master's Dissertation in Computer Engineering at the Instituto Superior de Engenharia do Porto (ISEP), focused on the integration of secure software development practices (SSDLC) and the migration of on-premise applications to the Microsoft Azure platform, with particular emphasis on Azure Container Apps. The primary goal was to identify and implement tools to support the secure software development lifecycle, such as static code analysis, dependency analysis, and vulnerability detection, while also evaluating the technical and organizational feasibility of migrating existing applications to the cloud, within an enterprise environment governed by zero-trust security policies. Through the practical integration of tools like Teamscale, OWASP Dependency-Check, and Snyk, along with the automation of pipelines in Azure DevOps, it was possible to significantly improve development and continuous delivery processes, ensuring early detection of quality and security issues. Additionally, the successful migration to Azure Container Apps allowed for infrastructure modernization and simplified operations such as monitoring and version updates in production environments. This study contributes not only to the internal efficiency of the team, but also to the practical literature on DevSecOps and cloud migration, potentially serving as a reference for other teams within the organization or even for other companies in similar contexts.
This document presents the main findings of the research conducted as part of the Master's Dissertation in Computer Engineering at the Instituto Superior de Engenharia do Porto (ISEP), focused on the integration of secure software development practices (SSDLC) and the migration of on-premise applications to the Microsoft Azure platform, with particular emphasis on Azure Container Apps. The primary goal was to identify and implement tools to support the secure software development lifecycle, such as static code analysis, dependency analysis, and vulnerability detection, while also evaluating the technical and organizational feasibility of migrating existing applications to the cloud, within an enterprise environment governed by zero-trust security policies. Through the practical integration of tools like Teamscale, OWASP Dependency-Check, and Snyk, along with the automation of pipelines in Azure DevOps, it was possible to significantly improve development and continuous delivery processes, ensuring early detection of quality and security issues. Additionally, the successful migration to Azure Container Apps allowed for infrastructure modernization and simplified operations such as monitoring and version updates in production environments. This study contributes not only to the internal efficiency of the team, but also to the practical literature on DevSecOps and cloud migration, potentially serving as a reference for other teams within the organization or even for other companies in similar contexts.
Description
Keywords
SSDLC DevSecOps cloud migration Azure Container Apps Migração para a nuvem