[Autogenerated] we walked through this slide in a previous module.
What I want to do here is take you step by step through a strategy for helping
you to succeed in rolling out today of SEC UPS processes.
It can be overwhelming.
There's lots of different phases with ended development.
Life cycle.
If you already have a product as being shipped to production regularly,
people are going to become quite nervous if you suggest making
amendments to that build on deployment process.
So let's have a look at how we can approach this with the
greatest caution for also being pragmatic.
Starting at the planning phase,
we could look the threat modelling and coding standards
and try to influence developer activity.
By introducing these concepts, however,
most organizations should have coding standards in place.
In this context, we're talking about secure coding standards.
Trepp modeling is something that requires some investment in time for
training on experience before you can become really effective.
For that reason,
I will be suggesting you leave trip modeling until
a later phase in your rollout.
Let's move on and look at what we can do in the code
section where code is being written.
It's definitely a good opportunity to get involved.
Winning over the developers is always important when you're
interfering with their build pipelines.
Undertaking some static cold analysis can be really valuable in this phase.
I suggest you start with taking some static code analysis tools
on getting them integrated with your bill.
Pipeline developers will love hearing feedback about
vulnerabilities in code they checked in.
It's far better than hearing about just before you
deploy something to production again.
Start with non blocking changes.
Don't try to break any bills at this stage.
Once you've mastered a cold analysis section moving on to the build activity,
it would make sense to introduce some vulnerabilities gunning on the belt code.
There's many different scanners available,
and these can be very non intrusive,
capturing vulnerabilities before this system goes the test
on before it gets released production,
I would focus on this area to start your Dev Sec ups Roller.
The other phases in the life cycle have many other different
types of activities that can come in time.
Don't be trying to attempt to deploy all of these activities at the same time,
start on the left inside and gradually mature your way over to the
right inside to cover all aspects off the life cycle.