Please enable JavaScript.

Coggle requires JavaScript to display documents.

Secure Application Development, Deployment and Automation - Coggle Diagram

- - - - Applications/Application
        Environments (are deployed on
        top of Infrastructure)
        
        Application Environment
        
        Applications that are being updated
        or newly developed are deployed
        to different environments
        
        Different environments or phases
        help to catch and spot potential bugs issues
        
        Different environments
        include local (devs machine),
        dev, staging, pre-production,
        production
        (Basically dev environments
        before production)
        
        environments are
        separated either physically
        or virtually (VLAN)
        
        1 more item...
- - - - So basically checking app
        hasn't changed aka
        the
        Integrity Measurement
        
        Measurement is done by
        collecting data about system hardware, config
        or application
        
        using hashes to
        confirm integrity aka
        attestation challenges
        
        Attestation like can you
        attest to something, can you confirm
        similar to validation, is it valid,
        
        this attestation challenge
        is done by creating a hash key
        or cryptographic key
        (this key used to validate or attest
        to any changes being made)
        
        Attestation is done by
        Trusted Platform Module/TPM
        (technology/chip)
        
        1 more item...
- - - - Changes made by DevOps
        (or combination of development and
        operations)
        are focused on quick response to change requests
        
        using automation and control tools
        
        Change management is
        similar to Version control
        
        managing and tracking changes
        to source code
        
        Version control may
        store data elsewhere
        aka distributed storage,
        multiple server or single server
        
        Benefits
        
        1 more item...
- - - - Developer or Vendor
        chose when or when
        not to patch vulnerabilities
        
        Patching/reducing vulnerabilities
        is known
        as Software Assurance
        
        Part of Assurance
        is Secure coding
        to prevent vulnerabilities
        
        Prevent Vulnerabilities
        using good and secure
        coding practices aka
        Secure Coding Techniques
        
        Secure/best practices
        from
        the Software Assurance Forum of Excellence in Code
        aka SAFECode
        
        Founded by
        EMC, Juniper Networks, Microsoft,
        SAP and Symantec
        
        1 more item...
        
        Other than using properly
        secure coding phases,
        important to reduce visibility/exposure
        of code itself
        
        1 more item...
        
        Maybe situations,
        where external code is used
        
        1 more item...
        
        Input validation
        
        1 more item...
        
        Data Exposure
        
        1 more item...
        
        Alternative type input.
        Not user input,
        but input from installing software/firmware
        
        1 more item...
        
        another result of input validation
        or another type of malicious input
        
        1 more item...
        
        Supplement secure
        coding practices
        with knowledge of potential vulnerabilities
        
        Top 10 list of vulnerabilities
        published by OWASP
        (Open Web Application
        Security Project)
- - - - aka how
        Resilient is system,
        how much can it
        take/withstand or endure
        
        aka
        Resiliency
        
        part of resiliency,
        is having a good and quick response to potential threats
        
        this is where
        Automation and Scripting
        comes in
        
        Automation systems
        use machine learning to
        quickly detect and respond to threats
        
        includes maintaining
        critical services
        (so system doesn't fail completely)
        
        1 more item...
        
        Resiliency needs to also
        be part of development
        
        Meaning the SDLC
        (Software development life cycle)
        
        add Security to
        SDLC
        
        this is where
        DevOps and security combine
        for
        Secure DevOps
        
        1 more item...
- - - - Scalability and
        Elasticity
        
        Scalability deals
        with more permanent
        or persistent growth
        
        adding or removing resources
        because business is
        growing or shrinking
        
        Elasticity
        (think elastic, it expands
        and contracts)
        
        Dynamically increases
        or decreases infrastructure
        resources
        
        so resources can be quickly
        added or removed to match
        workload (when needed).
        
        aka temporary demand
        or fluctuation
        
        increase and decrease
        can be automated
        
        1 more item...