Hands-On Security in DevOps

Summary

In this chapter, we looked at how to establish a security review policy for every release. We learned that it was recommended that the security assessment scope is based on the application release objective. For example, a new and major application release should have a full security assessment. A third-party component update release may focus on the integration interfaces instead of a full-scope assessment. In addition, the security review can be done in different stages, such as the self-assessment by the product development team, the prerelease assessment by the security team, and the product security assessment by the operations team.

The security checklist and the related testing tools for the pre-production deployment release ...