Part 4: Security Doesn't End When You Deploy
When we deploy software to production, we expect it to work as designed. We have tests, code reviews, security controls, and other practices that help reduce the likelihood of something going wrong. But as we’ve discussed throughout this series, none of these controls can guarantee that a system will never be compromised. There are things we don’t control, such as a security issue in an external service or API, or a newly discovered zero-day vulnerability in one of the dependencies we use.
If someone exploits a vulnerability, gains unauthorized access, or abuses legitimate functionality, would we know? And once we identify the problem, how prepared are we to investigate, contain, and recover from it?