The security practices of the development team consist of secure coding and secure build delivery. For the secure coding, we can have an IDE plugin do the code scanning, or we can also require security unit testing and run a static code scan of the whole project. For the secure build delivery, we need to ensure that the compiler options are configured properly and review all the dependency components for known vulnerabilities. The following diagram shows the overall security practices we can plan into the development stage. We will introduce some of the open source security tools and practices for these security activities in the upcoming sections:
Security practices in development
Get Hands-On Security in DevOps now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
