Information Security Fundamentals, 2nd Edition

248  ◾  Information Security Fundamentals

interacting with other elements in the system. erefore, code should also be tested

for vulnerabilities when in place and running. If the development team is given a

vulnerabilities scanner, they can test their own code in the development environ-

ment during the unit/functional testing and resolve any important findings before

promoting that code to QA for system/integration testing. However, vulnerability

testing should be done again in QA before the code is migrated to production. In

the security field, separation of duties is often recommended as a way of preventing

a single person from being able to ...