Hands-On Security in DevOps

Summary

In this case study, we reviewed a typical e-commerce website's adoption of security practices for the requirement, architecture, security framework, design review, and threat-modeling stages. We discussed the role of the security team and also the challenges for the DevOps team in adopting the security practices.

The team did an architecture assessment by applying OWASP ASVS. The team identified that there are some security areas that can be improved, including authentication, authorization, session management, and data-input validation. In addition, the team was also looking for advice on the implementation of privacy by design.

For the authentication process, they discovered that some of the sensitive information, such as the encryption ...