From the course: ISC2 Certified Secure Software Lifecycle Professional (CSSLP) (2023) Cert Prep

Unlock the full course today

Join today to access over 24,700 courses taught by industry experts.

Storing and managing security data

Storing and managing security data

From the course: ISC2 Certified Secure Software Lifecycle Professional (CSSLP) (2023) Cert Prep

Start my 1-month free trial Buy for my team

Storing and managing security data

“

- [Presenter] In addition to the source code, your release process should account for the security data that your application needs to function. And what do I mean by security data? This includes things like credentials, secrets, keys, certificates, and configurations. Back in the very first domain, Secure Software Concepts, we discussed identity and access management, or IAM. As your application moves through its lifecycle from design to development and eventually to deployment, you can start to see how these concepts are applied at each stage. This is a great example. When you deploy your application and the ops team takes control, that team needs access to security data in order to administer and manage the application. End users also need to log in, and trusted applications need the ability to authenticate to and interact with your application. As a CSSLP, it's your responsibility to make sure that data is accessible to the right people and to trusted integrations, but not…

Contents