Added notes for ssdlc

Neeo-w · Jul 5, 2022 · e0715f2 · e0715f2
1 parent f6ae800
commit e0715f2
Show file tree

Hide file tree

Showing 3 changed files with 69 additions and 0 deletions.
diff --git a/Assets/secure_design_and_dev.png b/Assets/secure_design_and_dev.png
diff --git a/Assets/ssdlc.png b/Assets/ssdlc.png
diff --git a/CloudSecurity/SecureCloudApp/README.md b/CloudSecurity/SecureCloudApp/README.md
@@ -1 +1,70 @@
 # Securing Cloud Applications, Users & Related Technologies
+
+1. [Secure Software Development Lifecycle (SSDLC)](#secure-software-development-lifecycle-ssdlc)
+2. [Testing & Assessment](#testing--assessment)
+3. [DevOps & Immutable](#devops--immutable)
+4. [Secure Operations, Architecture & Related Technologies](#secure-operations-architecture--related-technologies)
+5. [Identity & Access Management (IAM) Definitions](#identity--access-management-iam-definitions)
+6. [Identity & Access Management (IAM) Standards](#identity--access-management-iam-standards)
+7. [Identity & Access Management (IAM) in Practice](#identity--access-management-iam-in-practice)
+
+## Secure Software Development Lifecycle (SSDLC)
+
+* How Cloud changes AppSec:
+
+  * Opportunities:
+
+    * Higher baseline security
+    * Agility
+    * Isolated environments
+    * Independent VMs for microservices
+    * Elasticity
+    * DevOps
+    * Unified interface
+
+  * Challenges:
+
+    * Limited visibility
+    * Increased app scope
+    * Changing threat models
+    * Reduced transparency
+
+* AppSec phases:
+
+  * Secure Design & Development - training, SSDLC, pre-deploy testing
+
+  * Secure Deployment - code review, testing, vulnerability assessment, deployment
+
+  * Secure Operation - change management, app defenses, ongoing assessment, activity monitoring
+
+* SSDLC framework:
+
+![SSDLC framework](../../Assets/ssdlc.png)
+
+* Impact of cloud on SSDLC:
+
+  * Risks change; more support from cloud provider
+
+  * Large changes in visibility & control
+
+  * Management plane and metastructure part of threat model
+
+  * DevOps; managed via APIs
+
+* Secure Design & Development:
+
+![Secure Design & Development](../../Assets/secure_design_and_dev.png)
+
+* Threat modeling is done to get a view of all possible threats; one example is STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). The threat models are later mapped to their countermeasures.
+
+## Testing & Assessment
+
+## DevOps & Immutable
+
+## Secure Operations, Architecture & Related Technologies
+
+## Identity & Access Management (IAM) Definitions
+
+## Identity & Access Management (IAM) Standards
+
+## Identity & Access Management (IAM) in Practice