Hands-On Security in DevOps

Stage 1 – basic security control

In this stage, we may be dealing with a start-up company. No dedicated security team is part of the IT team. Most security controls are adopted from cloud services, such as AWS.

Although the cloud service may provide security services, it's still the user's responsibility to protect the application and data. Therefore, the following are critical for the security assurance program at this stage. Take AWS service practices as an example:

• Leverage third-party cloud service provider security mechanisms (for example, AWS provides IAM, KMS, security groups, WAF, Inspector, CloudWatch, and Config)
• Secure configuration replies on external tools such as AWS Config and Inspector
• Service or operation monitoring may ...