We have discussed secure architecture and design principles, threat modeling, and secure coding practices. In this chapter, we will examine a case study to discuss the implementation of security by design and privacy by design. The case study will show us the common challenges a DevOps team may have to face when applying security practices, and how the security team may help to provide best practices, tools, a security framework, and a training kit.
The case study will begin with a security assessment by OWASP ASVS, and will further identify the required security improvements, such as authentication, authorization, session management, data input/output controls, and privacy by design. We will look at some of the suggested tools and open source security framework implementations. In addition, the third-party components will also introduce...