1

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. Since I am planning a new staging environment for Dev - Test -Stage -Production, the whitebox penetration test topic is always up to date. But also, unfortunately, I have not paid attention to the adaptation of the definition of Ready and Done with regard to security aspects. Especially in the area of RESTAPI development there are several guidelines that should be observed. Whether now already from the planning out, above evenly on the developer level.

But only several questions that build on each other:

  • How do I plan the definition of Ready and Done so that the security relevant rules are adhered to?
  • How do the security rules behave within an agile process?
  • How do I evaluate the security policies within the agile process?
  • Where exactly within my agile planning do I apply the security aspect?
  • Is static code analysis sufficient in the development environment?
  • Even before I plan something, I start with the design to secure it. But how do I evaluate these safeguards?

closed as too broad by Conor Mancone, Xander, MechMK1, multithr3at3d, A. Hersean Aug 7 at 11:44

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

How do I plan the definition of Ready and Done so that the security relevant rules are adhered to?

It's really hard to give a specific answer to this, because each company is a little bit different, but here are some really good tips on what and what not to use: https://www.owasp.org/images/7/76/Jim_Manico_(Hamburg)_-_Securiing_the_SDLC.pdf

How do the security rules behave within an agile process? How do I evaluate the security policies within the agile process? Where exactly within my agile planning do I apply the security aspect?

It's a never ending process, ideally you would put the tests in your CI/CD pipeline, but where exactly to put them and how to evaluate them, is very dependent on what are your current processes in development. You should put in work towards an SDLC (Software Development Lifecycle) plan, which would give you a good insight in where to put the security controls and than create a SSDLC (Secure Software Development Lifecycle) plan on where they are implemented, so that there is a clear guideline on how the security takes place.

Is static code analysis sufficient in the development environment?

The best path is to have static code analysis, dynamic tests on a running instance (SQLi, XSS, etc.) and to check dependencies for potential vulnerabilities. Where to fit each of these tests is really up to your CI/CD pipeline.

Even before I plan something, I start with the design to secure it. But how do I evaluate these safeguards?

The best way to evaluate them is by doing external audits and penetration tests. You can also do these parts internally, but it should be someone who is not associated with the product you are creating, for they could be bias in the evaluation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.