97 Things Every Application Security Professional Should Know

Chapter 25. TAP Into the Potential of a Great SSDLC Program with Automation

Jyothi Charyulu

A successful secure software development life cycle (SSDLC) depends on having intentional thought, taking action, and persevering. Remember TAP: think, act, and persevere for success.

Think

First, create a vision and strategic multiyear road maps. Your vision defines why you do something.

Own the mission, strategy, product life cycle, and value creation for SSDLC and enterprise teams. Create a strong why based on industry trends, business drivers, threat landscape, and enterprise architecture and systems. Here are the top three points to consider when defining your vision:

Gather customer feedback.

Ask what works, what behaviors are encouraged, and what the biggest bottlenecks are. Digest the data, analyze it, and create a customized gap analysis based on your company’s threat landscape and inventory.

What are the drivers?

Business cases help show why your project is worth the company’s or client’s time, money, and resources.

Think about platform engineering, internal pipelines, and automation.

How easy are these to use, configure, scale, and deploy? How can the vision/strategic road map drive down the overall risk of the firm by proactively scanning, identifying, mitigating, and remediating security vulnerabilities across all the applications?

Act

Second, act on your vision ...