64 docs tagged with "segurança"

Reinforced practices for environments with a high level of criticality, exposure or regulatory requirements.

How to use AI/GenAI to accelerate security testing (planning, triage, regressions, fuzzing and validation) without degrading evidence, confidentiality or human control

Responsibilities of the AppSec Engineer in the SbD-ToE

Prescriptive validation, evidence and control strategies to ensure a secure, auditable and verifiable adoption of Infrastructure as Code.

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Practical example of applying security testing practices to an application classified as L3, with full pipeline integration and findings management.

A case study demonstrating the integrated, authorship-independent application of Security in Infrastructure as Code practices throughout the whole lifecycle.

Foundations, objectives and framing of the chapter dedicated to secure architecture in the software lifecycle

Instrument for binary and auditable verification of the practical adoption of continuous security validation practices.

Validations of the pipeline's own code (YAML, scripts, linters), including control of logic, permissions and the use of external components.

Strategies and practices for continuously validating application security through automated, manual and offensive testing.

Organisational policy that defines the requirements, execution criteria, findings management and responsibilities for dynamic security testing (DAST) and fuzzing, proportional to the application's risk level.

Practices for managing and validating external dependencies to ensure integrity, currency and security in the code

Dynamic testing at runtime to detect vulnerabilities by simulating external interactions.

Catalogue of typical events to monitor for operational and security purposes.

Specifics of exception management in the context of secure development - SAST, linters and code review

Technical and organisational mechanisms to ensure automatic enforcement of security policies in IaC pipelines.

Strategy for ensuring that all code executed in production has previously been validated and authorised.

Recommendations for writing secure code by language and stack, including prohibited patterns and validated good practices

Minimisation, hardening and effective verification of permissions in images and containerised environments

Integration of Secure Architecture practices throughout the development cycle

How to apply secure CI/CD practices throughout the application lifecycle, with proportionality by risk, normalised user stories and auditable evidence

How to apply the prescribed container security practices throughout the development and operations lifecycle

Practical integration of upskilling and onboarding practices into the development lifecycle

Practical integration of IaC security practices into the SDLC, with proportionality by risk, reusable user stories and auditable evidence

Practical integration of continuous validation practices across the different phases of the application lifecycle

Security practices for the definition, validation and management of infrastructure as code

Mechanisms for continuous feedback of security test results to development and product teams.

Automated execution of security tests as part of CI/CD pipelines, with traceability and thresholds.

Secure coding practices, curation and selection of guidelines, automated validation and governance during development

Rules and tools for security validation directly in the development environment (pre-commit, IDE, CLI)

Prescriptive practices for the governance, validation and control of reusable modules in IaC, ensuring security, provenance and traceability.

Identification and definition of the technical and operational domains to be monitored in modern systems.

Planning and control strategies to ensure an effective and auditable adoption of security practices in Infrastructure as Code.

Formal policies required to legitimise and operationalise the continuous validation of application security.

Definition of automated policies in the pipeline with security gates that vary according to the risk level of the application.

Complete example of a CI/CD pipeline with execution of *containers* in a secure and validated environment

Why this chapter is exceptional, which sources support the IaC requirements catalogue and how to create/adapt the organisational catalogue

Strategies for the secure management of releases and the segregation of functionality during continuous delivery.

Measures to segregate runners by application, avoid persistence and ensure ephemeral, controlled execution environments.

Assurance of secure and controlled execution of containers in pipelines and shared environments

Security practices for continuous integration and delivery pipelines, with a focus on automation, traceability and control proportional to risk

Principles and controls to ensure a secure, validated and traceable deployment process in production environments

Effective application and verification of security, isolation and control practices for containerised workloads

Formalised and executable procedure for the secure termination of contractors and suppliers

Strategies to protect secrets in pipelines, avoid hardcoding and ensure secure injection via vaults or variables.

Responsibilities of the Security Champion in SbD-ToE

Process for triaging, prioritising, tracking and resolving vulnerabilities detected in security testing.

Organisational policy that defines the requirements for security monitoring in production, including the definition of critical events, SIEM integration, behavioural correlation, coverage of monitoring domains and periodic review of detection rules, proportional to the criticality level (L1, L2, L3).

Recurring validation of previously fixed vulnerabilities to prevent their reintroduction in future versions.

Definition, application, validation and traceability of application security requirements by risk level

Organisational policy that defines how security requirements must be selected, documented, traced, validated and maintained throughout the lifecycle of each application, proportionally to its classified risk level.

Strategies for prioritising tests based on risk and ensuring effective coverage of the requirements.

Strategies and practices for continuously validating application security through automated, manual and offensive testing

Techniques and tools to ensure the presence of security controls directly in source code

Integration of security validators (SAST, secrets, IaC, containers) directly into the pipeline, with mandatory execution.

Responsibilities of Software Architects in the SbD-ToE

Application of static testing to source code for early detection of vulnerabilities and security flaws.

Documenting and aligning security practices across teams, promoting coherence and a common technical baseline

Mandatory verifications before the promotion of code to production, including security, functionality and readiness.

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Techniques to ensure traceability of changes, use of tagging and secure version management in IaC.

Good practices and controls for the secure use of generative AI tools in code writing and automated review

Minimum questionnaire to validate the knowledge of external staff with technical permissions