Securing an application runtime environment

Despite our best efforts to address security issues early on, unforeseen vulnerabilities can emerge in software production. Also, the complexity of modern applications means that some risks may only become apparent during actual operation.

If we embrace a zero trust mindset (and we should), we need to accept that no system/process is perfectly secure and prepare for possible security breaches. This is known as an “assume breach” mentality. This is why DevSecOps does not stop at deployment. Runtime security should be integrated as a last line of defense to govern, identify, protect, detect, and respond to security issues as they happen in live applications and recover from them. The first point of this integration is the implementation of runtime gates and guardrails to prevent the most critical risks from being deployed if earlier checkpoints are bypassed.

Implementing runtime security gates to stop critical risks

Security...