Most of the development team's daily activities include coding, compiling/building, testing, and deployment. Our goal is to build security automation practices into these activities. In the coding stage, the development team can use IDE plugins to do security source code analysis. In the build stage, we scan for the secure hardened compiling options and the known vulnerabilities of the dependency components, as well as the secure source code for the whole project.
Once the build is ready and installed on the staging environment, more comprehensive security scanning will be performed, such as dynamic web security testing by OWASP ZAP, infrastructure configuration security, and secure communication protocols. In the production deployment, security scanning will also be performed regularly, and will be more focused on security monitoring instead...