Summary

This chapter provided the foundation for establishing a secure software development platform in any organization.

First, we reviewed the various activities to perform in the SSDLC, such as the TARA/threat model, requirements review, design review, code review, SAST, vulnerability scanning, fuzz testing, DAST, IAST, and penetration testing.

Then, we discussed how to create a project inventory as this helps an organization better understand the security posture and plan, manage, and track cybersecurity activities for each project based on the risk level.

This chapter also provided a step-by-step practical guide on how to establish a secure software development platform. Specifically, we described the workflow where different project development teams can run a set of automated AppSec tooling in a CI pipeline. The different project development teams can define specific requirements and criteria for when which types of tools should be executed. Examples of AppSec tooling...