Now, throughout the software development life cycle, the continuous
implementation and continuous
development, there's a lot of security questions that we have. And I use the
word questions for
reason because there's a couple of questions that we should always be asking
throughout any of
these processes. And also the implementation through the previous skills that
we've done as well.
Let's take a look at some of them and ask why? What does the operation/program
look like before and
after a change? Now, this is really important because we need to be able to do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
after a change? Now, this is really important because we need to be able to do
a compare and
contrast to what we did before and what it looked like afterwards. Is that
secure? Is that allowed?
Because that goes into our next question of who has access to that data.
Because if we have an
implementation that opens up access to everybody inadvertently, well, then we
got a problem. Are we
testing everything and logging everything? Because while we are making sure
that the patches in
development that we work on implements correctly, we want to make sure that
everything is being WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
everything is being
tested to make sure that there's no bugs behind the scenes just because you can
't see a problem
doesn't mean that one doesn't exist. And speaking of logging, did we log the
entire process of
implementation to include software and our equipment used? Because it may not
seem like it on the
physical side, but even with a cloud environment and software development,
there may be physical
equipment that we used that we need to know more information about. And did we
perform any manual
checks? Because we need to make sure that we're going through and double
checking ourselves along with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
checking ourselves along with
the actual developers inside of the software development life cycle. And this
plays into probably the
most important question. Do we have an SOP to cover our security implementation
operations? See,
we don't want to just do willy and illi every program or development that comes
through and
apply a different standard to it. We need to have a baseline standard and then
and on a case by case
basis apply different security scrutiny's to whatever it is that's being
developed or proposed
based on what it actually is that's being worked on for instance. Software WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
based on what it actually is that's being worked on for instance. Software
scrutiny for a security
concern is going to have different questions asked about it and different
checks done to it.
Then a hardware implementation. And that's because of the actual coding. Yes,
you can go in,
work on firmware, machine code, and all this other great stuff. But I'm talking
about general
up physical upgrades. Let's say you change a video card and something for
whatever reason.
And that video card has a actual flaw on one of the chip designs. Well, that's
a physical hardware
problem. Did we do anything to that chip before we installed it? And these are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
problem. Did we do anything to that chip before we installed it? And these are
questions that we
develop along the way based on that second set of eyes that we've been
emphasizing throughout the
entirety of the integration and development process. Now you may be thinking
that that's a lot to cover
as far as different questions that we have about security. But fear not, we
actually have a little bit
of a guide to help us build a baseline in case we need to. Now what I'm looking
at is the DevSecOps
actual GitHub. I have the link for this below the video to go through and allow WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
actual GitHub. I have the link for this below the video to go through and allow
us to be able to go
through and look at different pieces of information concerning different
security factors
throughout the organization. I'm providing this as a resource for you out there
to be able to go
through and just take a browse to go and see the different areas that this Dev
SecOps checklist
and different projects covers. Some of it may cover something you're working on
. Some of it may not.
Some of you may be able to piece together to make your own actual standard
operating procedure
for in terms of security for your organization. By all means, definitely go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for in terms of security for your organization. By all means, definitely go
through here. And also,
don't be afraid to check out resources like NIST, Cybersecurity Framework as
far as making sure that
we're meeting all the security standards. And it helps in making sure that we
can run vulnerability
analysis and making sure there are no backdoors into any kind of programs out
there that we don't know
about. Overall, DevSecOps plays a big part in what we're doing as far as making
sure that our
organization is secure not only within the organization, but inside of its WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
organization is secure not only within the organization, but inside of its
cloud presence as well.
Not just with software, platform, infrastructure as a service, but all
throughout the actual
different architects and environments that we may utilize. Be it here for one
single usage or
over a worldwide scope of different cloud environments that we hook up to our
organization.
Security is always of the utmost importance.