Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. Since I am planning a new staging environment for Dev - Test -Stage -Production, the whitebox penetration test topic is always up to date. But also, unfortunately, I have not paid attention to the adaptation of the definition of Ready and Done with regard to security aspects. Especially in the area of RESTAPI development there are several guidelines that should be observed. Whether now already from the planning out, above evenly on the developer level.
But only several questions that build on each other:
- How do I plan the definition of Ready and Done so that the security relevant rules are adhered to?
- How do the security rules behave within an agile process?
- How do I evaluate the security policies within the agile process?
- Where exactly within my agile planning do I apply the security aspect?
- Is static code analysis sufficient in the development environment?
- Even before I plan something, I start with the design to secure it. But how do I evaluate these safeguards?