Hi there, welcome back. In this lecture, we're going to dive into inspection and validation of code base for compliance. Despite the importance of data security. with every new day, it seems a new story about another data breach pops up. Whether it's credit card data being stolen, website logins being hacked, or other personal data that's stolen it's a problem.

So what's happening?

Everyone knows that organizations need to protect information from people that shouldn't have access to it, however, they also need to make sure that customer information isn't altered or destroyed when it shouldn't be. On the flipside, organizations also need to ensure that data is destroyed when it's supposed to be. Users need to be properly authenticated before getting access to data and those users need to have the proper permissions to do so. Using historical data archive data and logs should allow organizations to track down evidence when something has gone wrong.

Building secure applications is a big part of security however it can be difficult to do this. While you may find it surprising many developers and other IT professionals assume that they understand security. In reality, they really don't. This is because the entire cyber security discipline is always evolving, which is not unlike any other IT discipline. That being the case ongoing education and training is critical.

When developing secure applications it's important that you ensure that the code is created correctly and that it securely implements any features that are required. On top of that you need to ensure that the features themselves are designed with security in mind. This doesn't always happen.

Lastly, you need to make sure that when you're developing an application that the application is compliant with any special rules or regulations that it needs to comply with. It's important to test for this compliance during the build process and to retest periodically after deployment. This is because it's often rather difficult to shoehorn security into an application after the fact.

When all is said and done, it's important to recognize that secure development needs to be a part of every stage of the software development lifecycle. It's even more critical for applications that process sensitive or highly confidential information.

With the introduction of DevOps practices, it's now much easier for developers to integrate security testing into the app development pipeline. What this does is create an environment where security testing is part of the day-to-day delivery process rather than something that needs to be performed by security specialists after the fact.

Lectures

Introduction - Identifying & Recommending Quality Metrics - Feature Flags - Technical Debt - Team Structures - Performance Testing - Inspecting & Validating Code Base for Compliance - Inspecting & Validating Infrastructure for Compliance - Secure Development & Coding - Infrastructure Security Validation Tools & Practices - Conclusion