In this case study, we reviewed a typical e-commerce website's adoption of security practices for the requirement, architecture, security framework, design review, and threat-modeling stages. We discussed the role of the security team and also the challenges for the DevOps team in adopting the security practices.
The team did an architecture assessment by applying OWASP ASVS. The team identified that there are some security areas that can be improved, including authentication, authorization, session management, and data-input validation. In addition, the team was also looking for advice on the implementation of privacy by design.
For the authentication process, they discovered that some of the sensitive information, such as the encryption key, password, or secrets, may accidentally be committed in the source code repositories. The security team suggested applying...
