In this chapter, we looked at how to establish a security review policy for every release. We learned that it was recommended that the security assessment scope is based on the application release objective. For example, a new and major application release should have a full security assessment. A third-party component update release may focus on the integration interfaces instead of a full-scope assessment. In addition, the security review can be done in different stages, such as the self-assessment by the product development team, the prerelease assessment by the security team, and the product security assessment by the operations team.
The security checklist and the related testing tools for the pre-production deployment release were also discussed. The key area of the security checklist includes hidden communication interfaces, privacy information, secure communication...