Reinforce application security developed on AWS/ Azure - Options Most corporations are adopting a DevSecOps approach - by maximising automation and trying to reduce manual intervention as much as possible. In continuous delivery environment , most companies dont have the resources and probably not possible to have a team out of project to proceed with security test in a continuous delivery approach. When looking for a solution , here are the requirements that you should focus on : Detection of application code vulnerabilities: Cover the entire application Be able to set security rules Ability to perform incremental scans Acceptable false positive rate Detection must not impact application performance anonymization of the name of the applications for the vulnerabilities reported Automation of detection: Integration with Continuous delivery platforms (example: Concourse, Jenkins) Build in case of discovery of vulnerabilities Reporting: Integrate with bug management tools Raising indicators specific to each application in a portal Dont build i think its a mistake, the market is moving towards solutions that are SaaS and most of these companies are building a blackbox type of security solution, buy a market solution and integrate it here is a starter list: 1) Veracode https://www.veracode.com/ 2) Checkmarx https://www.checkmarx.com/ 3) IBM AppScan Entreprise https://www.ibm.com/security/solutions 4) Contrast Security Assess https://www.contrastsecurity.com/interactive-application-security-testing-iast
Adapt your sprint delivery, don't follow textbooks or best practices The question that is asked often by clients: How often do you release your product to your end users? How often do your end users see and use your product? Do you release in sync with your Sprint length, is it after the Sprint Review? Is the Sprint Review meeting the only valid release point? When do you plan your releases? Always adapt your Scrum and Continuous Delivery to build the right thing, - EVERY COMPANY IS DIFFERENT this takes time at the start to get used to working in this type of environment when implemented properly, release it as planned to ultimately deliver superior value to your customers. Its exactly the same as you ever wondered why your fingers are different sizes? In short, our fingers are uneven for various reasons, and all theories suggest the evolution of the hand is tightly related to its functionality , same as sprint delivery every company functions differently. Below a step by step approach that you should adapt to your company needs:
Scrum vs Kanban cheat sheet A friend of mine Mark sent me this excellent image that depicts the difference between Scrum vs Kanban , the image takes a complex idea that he breaks down to summarize the key deltas about both approaches.
