DevSecOps › Module 5 › Lesson 3
When to Scan
When to scan literacy names PR vs nightly vs pre-release triggers, scan cost, and false positive triage — schedule DAST on YOUR $DEVSEC_LAB without over-scanning stranger URLs.
Visual · t36_when_to_scan
When to scan literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Scan timing balances coverage and pipeline speed — literacy teaches when to run DAST on YOUR lab URL in CI without pointing tools at unauthorized targets.
DAST timing options include PR smoke — passive baseline on lab preview URL, nightly full active scan on $DEVSEC_LAB staging, pre-release gate before tag, and post-deploy verification. Long active scans belong off critical path — schedule against YOUR lab URL overnight. Never substitute stranger URLs because lab deploy is down. Cyberlium writes scan schedule row on YOUR $DEVSEC_LAB — trigger, scan type, lab URL, duration budget for one fictional app. Next: DAST Lab.
1. Scan schedule triggers (named)
PR: passive baseline on ephemeral lab preview — fast feedback on YOUR repo. Nightly: active scan on $DEVSEC_LAB staging URL — full coverage off critical path. Pre-release: gate before semver tag. Post-deploy: smoke DAST confirming lab URL health after CI deploy.
On $DEVSEC_LAB, write schedule row — trigger, scan type, lab URL, max duration for fictional app.
Command guide
Try these commands — Scan schedule triggers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Aqua Trivy — https://aquasecurity.github.io/trivy/ Trivy fs — https://aquasecurity.github.io/trivy/latest/docs/target/filesystem/ Trivy image — https://aquasecurity.github.io/trivy/latest/docs/target/container_image/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Install from https://aquasecurity.github.io/trivy/
macOS:
Command — copy this
brew install trivy
Windows: Download Trivy releases / use WSL
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_CONTAINER=${DEVSEC_CONTAINER:-$DEVSEC_LAB/container}
echo '=== trivy fs on YOUR container/ (optional if installed) ==='
if command -v trivy >/dev/null; then trivy fs "$DEVSEC_CONTAINER" --severity HIGH,CRITICAL 2>&1 | head -30; else echo 'trivy not installed — see notes/trivy-fallback.md'; fi
cat > "$DEVSEC_LAB/notes/trivy-fallback.md" <<'EOF'
# Trivy Fallback — tool not installed
Install: https://aquasecurity.github.io/trivy/latest/getting-started/installation/
Filesystem: trivy fs $HOME/cyberlium-lab/t36-devsec/container --severity HIGH,CRITICAL
Image (optional): docker build -t cyberlium-lab:dev $HOME/cyberlium-lab/t36-devsec/container
trivy image cyberlium-lab:dev
Scan YOUR artifacts only — never stranger registries without authorization
EOFCommand — copy this
grep -E 'trivy fs|trivy image|stranger' "$DEVSEC_LAB/notes/trivy-fallback.md" if command -v trivy >/dev/null && command -v docker >/dev/null; then docker build -t cyberlium-lab:dev "$DEVSEC_CONTAINER" 2>/dev/null && trivy image cyberlium-lab:dev --severity HIGH,CRITICAL 2>&1 | head -20 || echo 'docker build optional — trivy fs sufficient'; fi
Primary tools to practice this lesson: trivy, grep. Reference sites: Aqua Trivy (https://aquasecurity.github.io/trivy/); Trivy fs (https://aquasecurity.github.io/trivy/latest/docs/target/filesystem/); Trivy image (https://aquasecurity.github.io/trivy/latest/docs/target/container_image/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why timing literacy prevents pipeline bottlenecks
Full active DAST on every commit slows merges. Missing pre-release scan ships XSS to lab staging unnoticed. Documented schedule aligns security coverage with delivery cadence on repos you own.
Students document lab scan calendar on notes — production schedules follow SRE and security SLAs.
3. Lab boundary
Forbidden: scanning stranger URLs because lab deploy failed. Allowed: when-to-scan card — schedule with $DEVSEC_LAB lab URL targets only.
Ship: when-to-scan card for YOUR lab app. Next: DAST Lab.
4. What you ship: when-to-scan card for $DEVSEC_LAB
PR, nightly, pre-release triggers with lab URL. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. When-to-scan card. $DEVSEC_LAB named. File t36-m05-l03-when-to-scan.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run full active DAST on every PR against stranger site. Skip DAST entirely because 'SAST is enough.'
Right
Write when-to-scan card for YOUR $DEVSEC_LAB. Next: DAST Lab.
Mission: schedule DAST on YOUR lab URL
1) Define PR, nightly, pre-release triggers. 2) Write schedule row with lab URL per trigger. 3) Set duration budget per scan type. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Lab URL down? Fix deploy — never aim ZAP at stranger sites as substitute.
Knowledge Check
APPLY: Nightly active DAST on Cyberlium targets:
Multiple choice
Knowledge Check
APPLY: True or False: PR-stage DAST often uses faster passive baseline on lab preview.
True or False
Knowledge Check
APPLY: When-to-scan literacy on Cyberlium uses:
Multiple choice