Security

Security is not an afterthought—it must be integrated throughout the software development lifecycle. For regulated software, security is both a quality imperative and a compliance requirement.

Security in the Development Lifecycle

Core Security Principles

Defense in Depth

Apply multiple layers of security controls:

Principle of Least Privilege

Grant minimum permissions necessary:

Secure by Default

• Deny access unless explicitly permitted
• Encrypt data at rest and in transit
• Enable security features by default
• Require explicit opt-out for security controls

Security Considerations

Infrastructure Security

Denial of Service (DoS/DDoS) Mitigation:

• Rate limiting at API gateway
• CDN with DDoS protection
• Auto-scaling to absorb traffic spikes
• Geographic restrictions where appropriate

Security Information and Event Management (SIEM):

• Integration of multiple data streams
• Threat analysis based on analytic rules
• Correlation of security events
• Automated alerting and response

Intrusion Protection Systems (IPS):

• Network-based sensors
• Host-based intrusion detection
• Behavioral analysis
• Automated blocking of malicious activity

Network Forensics:

• Full packet capture capabilities
• Root cause analysis tools
• Incident reconstruction
• Evidence preservation for compliance

Anti-Malware Protection:

• Endpoint protection on all systems
• Zero-day threat detection
• Malware signature identification
• Automated quarantine and removal

SecDevOps Integration

Security must be integrated into DevOps practices:

Security Team Approaches

Security in CI/CD Pipeline

# Example security-integrated pipeline
stages:
  - lint
  - security-scan
  - build
  - test
  - security-test
  - deploy

security-scan:
  stage: security-scan
  parallel:
    - script: npm audit --audit-level=high
    - script: trivy fs --severity HIGH,CRITICAL .
    - script: semgrep --config auto .

security-test:
  stage: security-test
  script:
    - zap-baseline.py -t $APP_URL
    - nuclei -u $APP_URL -severity critical,high

Compliance Frameworks

Security and Risk Assessments

For regulated systems, align with appropriate frameworks:

NIST CSF Core Functions

Security Testing Types

Testing Frequency

OWASP Top 10 Mitigations

Security Roles

See Specialist Roles for detailed role descriptions.

Best Practices

Do

• Integrate security into every phase of development
• Automate security testing in CI/CD pipelines
• Conduct regular threat modeling sessions
• Keep dependencies updated and scanned
• Implement comprehensive logging and monitoring
• Train developers on secure coding practices
• Practice incident response regularly

Don't

• Treat security as a final checkbox
• Store secrets in code or configuration files
• Ignore security findings until later
• Assume perimeter security is sufficient
• Log sensitive data (PII, credentials)
• Skip security reviews for "small" changes
• Rely solely on automated tools

Related Resources

• Threat Modeling
• Secure Coding
• Vulnerability Scanning
• Secrets Management
• Observability
• Microsoft Playbook: Security

Compliance

This section fulfills ISO 13485 requirements for planning of product realization (7.1), design inputs (7.3.3), design verification (7.3.6), improvement (8.5.1), and control of records (4.2.4), and ISO 27001 requirements for threat intelligence (A.5.7), vulnerability management (A.8.8), configuration management (A.8.9), network security (A.8.20), cryptography (A.8.24), and secure development lifecycle (A.8.25-29).

View full compliance matrix