The Android security was discussed in the previous chapter, and this chapter will focus on the infrastructure and platform security. For a PaaS platform or even SaaS service providers, the fundamental security requirement is to ensure that the infrastructure is secure. Therefore, the security operations team will need to do regular scanning on the infrastructure to ensure security configurations for security compliance. The infrastructure security includes the secure configuration with web services, database and OS, the secure communication protocol such as TLS v1.2, and the uses of secure versions of third-party components and dependencies. We will illustrate how to set up your own automated scanning framework to run these regular secure configuration inspections.
The topics to be covered in this chapter are as follows:
- The scope of infrastructure security...