Test and Verification -> Consolidation: Integration of vulnerability issues into the development process
Risk and Opportunity
Risk: To read console output of the build server to search for vulnerabilities might be difficult. Also, to check a vulnerability management system might not be a daily task for a developer.
Opportunity: Vulnerabilities are tracked in the teams issue system (e.g. jira).
Required knowledge: Low (one discipline)
Required time: Low
Required resources (systems): Very Low
Implementation hints: At SAST (Static Application Security Testing): Server-side / client-side teams can easily be recorded. With microservice architecture, individual microservices can be used usually Teams. At DAST (Dynamic Application Security Testing): vulnerabilities are classified and can be assigned to server-side and client-side teams.
OWASP SAMM 2 Mapping: i-defect-management|B|2
ISO27001:2017 Controls Mapping:
- not explicitly covered by ISO 27001 - too specific