Securing Your Code-Writing Tools
Your code-writing tools are one of the first links in the SSC. These tools are considerations both in the Analysis and Design phases of your SDLC. Threat actors try to attack code-writing tools to steal credentials and source code and poison your code with backdoors, trojans, and other vulnerabilities. By the end of this chapter, you will know how the development environment can be compromised and some concrete strategies for protecting this stage of building and delivering secure software.
In this chapter, we’ll cover the following topics:
- IDE/editor
- Version control and source code management tools
- Local build and test tools, and CI/CD tools
- Locally installed vs. containerized vs. cloud development environments
- Considerations around AI-generated code
