Understanding application security – setting and enforcing policies
Security is a moving target, and as technology advances, attack vectors increase and attackers become more and more sophisticated. Due to this, the process and ceremonies the team maintains around security are even more important than technology itself. This is not because technology doesn’t matter but because good discipline and the habit of a strong process allow technologies to plug in and out as the industry evolves.
One aspect of good discipline for security is maintaining accurate documentation and architectural diagrams. If a significant change is made to the application architecture, then that can change the risk surface areas and attack vectors. For example, an undocumented or underdocumented dependency on a library or a network port could result in exposure to a vulnerability that may be more difficult to determine.
Foundational application security
In Chapter 5, we discussed building...
