In this chapter, we learned about the security practices that take place during the continuous integration cycle in the coding, building, testing, and production deployment phases. For the development stage, we perform secure code scanning, secure compiling checks, and also vulnerable third-party component review. For the static code analysis, we also introduced some of the open source scanning tools for different programming languages. We have also learned how to enable compile-time defenses against buffer overflows, such as ASLR and NX.
For web security testing, we introduced testing approaches in proactive and proxy modes and discussed web automation testing tips to improve the testing effectiveness in terms of business logic, API fuzz, scanning scope, authorization, and integration. We also looked at Jenkins configurations and security automation plugins in Jenkins...