Zero Trust Security

Chapter 11 DevSecOps and Web Protection

We have now implemented multiple controls to help mitigate the probability of a material cyber incident. In this chapter, we will examine the trust we place in the code that our internal development team has created and how DevSecOps practices, which emphasise the importance of creating secure code and integrating security into the development process, can help. We will also discuss the DevOps framework called CALMS, static and dynamic code analysis, and introduce open-source tools to help with code analysis. Finally, we will deploy a Web Application Firewall (WAF) as a protective layer in front of our web shop.

Organisations with in-house development teams often fall into a pattern of inherently trusting their code’s security. However, this trust is rarely justified. Even large companies with substantial development teams, such as Meta, Apple, and Microsoft, have discovered vulnerabilities in their code that attackers have successfully exploited. However, Zero Trust does not lead to the writing of more secure code. The removal of trust in the development process can go a long way towards improving security. Simple things, such as removing hard-coded secrets from the code, such as IP addresses, application programming interface (API) keys and passwords, can go a long way. This is where DevSecOps comes into the picture. It is a cultural and technical movement that integrates security practices into the DevOps process. By embedding security ...