Hands-On Security in DevOps

Top common issues

A top-common-issues checklist can be very effective for a project team to decide what to focus on during secure code review. To build a top-common-security checklist, it's suggested to refer to the CWE Top 25. The security team and the project team may take the CWE Top 25 basis and in-house top security issues, based on historical project data, to reach a consensus of the top five security issues.

To summarize in-house top security issues is critical; it's because the CWE Top 25 may not be exactly the same for in-house projects, due to the business background, technology stacks, and the implementation. Once an in-house top-security-issue list is identified, it should also be listed with suggested mitigation approaches. Refer ...