Security testing evaluates software for vulnerabilities and weaknesses that could cause security failures or be exploited. It strengthens a product alongside quality assurance, usability, user acceptance, and load testing. section 10.1.4
Treat security as an activity throughout development rather than a final inspection. DevSecOps incorporates security testing and bug fixes into the development cycle, supporting early detection and mitigation of vulnerabilities. section 12.2.9
Practical security-testing responsibilities include:
- Use security tools early in development to detect and mitigate threats. section 12.2.9
- Integrate security checks into deployment pipelines, including internally developed tooling where appropriate. section 12.2.9
- Conduct comprehensive application security reviews before launching production services. section 12.2.9
- Fix discovered issues before release, supporting a code freeze that prevents regression after thorough testing. section 10.1.4
A safer release path
A team runs security checks during development, reviews the application before production launch, fixes identified vulnerabilities, and then freezes the code to protect the tested release. section 10.1.4 section 12.2.9
Figure 12.2 DevSecOps combines security with DevOps to ensure development of a secure product.
Use the DevSecOps figure to visualize how security joins DevOps across development rather than appearing only at the end. section 12.2.9
