The Challenge of Security in Agile Development
Traditional software development models (Waterfall in particular) dictate that before releasing the software product, a rigorous testing phase is performed. Traditionally, standard security assessments have fitted this model very well, with security assessments being performed before product release.
However, the current trend of agile software development models that do not separate design, development and testing as distinct and sequential phases creates an obstacle to security assessments – the product must either be tested continually (which is time-consuming and expensive), or a very particular version of the product must be assessed (which may be irrelevant at the next release, often within weeks or months). The problem is further exacerbated by semi or fully-automated releases and the supporting technologies – Continuous Integration, Continuous Delivery and Continuous Deployment.
Automating Security Testing for Agile Environments
The often-suggested solution to the increasingly automatic software production pipeline is to automate any other bottlenecks in the process. While automating software security testing is certainly not an easy task, it is becoming increasingly applicable to projects with strict security requirements, as it can drastically cut down the time required to identify security issues and, therefore, reduce the cost of fixing security defects.
With this service, the CyResLab team can assist with introducing automated security tests/test suites, either for integration within the client’s Continuous Integration (CI) system or as a standalone test suite that can be run manually. These tests can cover various software vulnerabilities.
Service includes
- Multiple tests, covering key vulnerabilities/vulnerability classes, such as:
- Injections and XSS
- CSRF
- Outdated software components
- Infrastructure and deployment configuration security issues
- Integration with the client’s existing CI/CD systems (if applicable)
Ideal for
Clients that develop software products with high-security requirements and/or regular security assessment needs.
Certification
Upon successful completion, attendees will receive a certificate from ESI CEE.
Enroll today and empower yourself to build secure and resilient systems!