Hands-On Security in DevOps

Privacy

There are two kinds of privacy information that need to be protected. One is the sensitive information related to the application security, such as the password, API key, encryption key, CA certificate, and the other one is the Personally Identifiable Information (PII), which is also regulated by GDPR. For the sensitive information review, the functions that relate to IAM, encryption, session management, logging, CA manager, and administration are those modules that directly handle the sensitive information. Here are the general testing guidelines for the privacy data-handling life cycle:

Data life cycle	Testing key points	Suggested testing tools
Transmission of data	Ensure the sensitive information is not transmitted ...