In this chapter, we discussed two typical business scenarios for security assurance program. One is building software on top of a third-party cloud service provider, and the other is building complete cloud services on top of your own cloud. Cloud service providers may allow security services to protect the platform and infrastructure, but it's still the cloud service tenant's responsibility to protect the web application and customer data in the cloud. Then, we discussed the adoption of Microsoft SDL and SAMM into security activities in different development and operations phases. For security training, we recommend delivering training based on roles and needs. How security culture impacts the security assurance program was also discussed.
Finally, we took security tool integration with CI/CD and the adoption of a web security framework as examples to explain...