Security of development in Agile projects (Agile Application Security: Enabling Security in a Continuous Delivery Pipeline)

Three years ago, I read this excellent book. book. At the time, I thought the book would help me familiarize myself with the current state of security. But the authors approached with great scope and set themselves the task: Tell developers what modern approaches to security look like Tell old-school security professionals what a modern development looks like, and that the prohibitionist approach from the past has stopped working with the advent of modern approaches like CI/CD.

At the very beginning there is a brief excursion into modern development in chapters: Head. 2. Elements of flexible techniques Head. 3. Revolution in Design Methods – Join us! Head. 4. Working with existing life cycle development These initial chapters provide such a good insight that they will be useful not only for security professionals, but also for developers working within flexible approaches, because sometimes following processes turns into a cargo cult or form worship as Feynman called it:) Therefore, sometimes it is worth remembering that it is not the process itself that is important for the sake of the process, but the results that it helps to achieve.

Next are the chapters on security. Head. 5. Security and requirements. Security is just another area of non-functional requirements and should be integrated into the process of working on the system from the beginning, such as the performance of the final solution or its convenience. Head. 6. Flexible vulnerability management. This is about how vulnerabilities are treated, how to account for them and how to plan for their elimination, and how testing and security are related. Head. 7. Risk for flexible teams. The whole chapter is devoted to the basics of risk management in the context of security issues. If you are already familiar with this area of knowledge, it will be difficult to find something new. Head. 8. Assessment of threats and understanding of attacks. One of the most important safety chapters:) Head. 9. Building safe and user-friendly systems. Here are options for designing security so that it eventually leads to a product that cannot be used, because security tools destroy the entire user experience. Head. 10. Code inspection for security reasons. Code review options are considered in terms of how to use them correctly to improve the security of the final solution. Head. 11. Flexible testing is safe. This is about how to test the code, infrastructures, and CI/CD Pipeline for security. The authors mention several tools that may be useful to practitioners. Head. 12. External inspections, testing and recommendations. The final sentence of this chapter is: “If you are not going to use external inspections to learn from experts, you are wasting their time and money.” Head. 13. Operation and security. It deals with monitoring and detection of intrusions, reaction to incidents, protection of CI / CD pipelay and working with secrets:) Head. 14. Communication to regulatory requirements. Here's being considered. 2 approach

1. Rule-based approach (Example: PCI DSS)
2. Results-based approach (Example of Reg SCI) This chapter is useful to read to understand the difference in these approaches, and at the same time read the human description of the rules described in PCI DSS, which are often mentioned in vain about and without:) Head. 15. Security culture. Very good about culture. Great about "pull, not push" and the principles of efficiency:
3. Promote, not block;
4. Transparent security;
5. Don't look for the guilty;
6. Scale security, strengthen flanks;
7. Who is as important as how Head. 16. What is Flexible Security?. Here's every one. 4The authors of the book tell their story and share how they came to security issues in development and crystallize their thoughts on the topic of the book.

#Sec #Security #Agile #Processes #Software #SoftwareDevelopment #DevSecOps