To conduct a security testing in CI mode, a FAST node must be sequentially run in two modes:
CI_MODE environment variable defines the operation mode of a FAST node. This variable can take the following values:
In this scenario, the FAST node first creates a test record and writes baseline requests to it. When the recording is finished, the node creates a test run that uses the prerecorded baseline requests as a basis for its security testing.
This scenario is shown in the picture below:
The corresponding workflow steps are:
Building and deploying the target application.
In recording mode the FAST node performs the following actions:
- Proxies baseline requests from the requests' source to the target application.
- Records these baseline requests in the test record to later create the security test set based on them.
Preparing and setting up a test tool:
Deploying and performing a basic configuration of the test tool.
Running the existing tests.
The FAST node will proxy and record baseline requests to the target application.
Stopping and removing the FAST node container.
If the FAST node does not encounter critical errors during operation, it runs until either the
INACTIVITY_TIMEOUTtimer ticks out or the CI/CD tool explicitly stops the container.
After the existing tests are complete, the FAST node needs to be stopped. This will stop the baseline requests recording process. Then the node container may be disposed of.
In testing mode, the FAST node performs the following actions:
- Creates a test run based on the baseline requests recorded on the step 4.
- Starts to create and execute a security test set.
Obtaining the results of the testing. Stopping the FAST node container.
If the FAST node does not encounter critical errors during operation, it runs until the security tests are complete. The node shuts down automatically. Then the node container may be disposed of.
This scenario assumes that the Docker container with the FAST node first runs in the recording mode, then in the testing mode.
After FAST node execution is finished in any of the modes, the node container is removed. In other words, a FAST node container is recreated every time the operation mode changes.