[Autogenerated] I want to talk for a moment about the various roles and
responsibilities involved in building a day of SEC UPS pipeline.
There's a number of different roles or activities I've identified here.
It's important to understand that these are
activities that need to be undertaken.
They're not necessarily full time roles or team members
that you need in your organization.
This is particularly important if you've got a small development team.
Def.
Sec apps does not mean you need to double triple the size
of your team in order to be successful.
What's more important than the size of your team is the
activities that your team members perform.
Tooling is important because the tooling is central to ensuring
consistency and effectiveness off the day of SEC ops processes.
You extend the Dev Up Pipeline by including security testing on
integrating with very security Tooth vulnerability Management is
another key activity that must be fulfilled,
ensuring that all vulnerabilities are managed blocking deployments
in accordance with your company's risk policy.
For example, if you have critical or high vulnerabilities,
you may prevent a deployment from going to production.
Looking at application security,
it is important that you have someone complement with
dealing with the application security fixes.
And finally, from a compliance point of view,
it's always important to ensure that you maintain proper records off the
testing and the outcomes of any remediation that are undertaken.
This will help you with demonstrating compliance.
You should look at all of these activities and see how you can
fulfill them within your existing team structure.
For larger, more mature organization,
you may have the privilege of being able to hire specialists who
are dedicated to each of these activities.