SSDLC-Wrap-up

OWASP SAMM + BSIMM(*)
 - Governance
 	* Establish SSG(Software Security Group)
 	* Security advisor -> Project

 - Construction & Verification
 	* Security Testing
 		- Code Review (Static Analysis)
 		- Pen Test (Dynamic Analysis)
 	* Automated
		- Jenkins
		- SonarQube
		- Dependency Check (A9)
		- SQLmap
 	* Security Requirements (CIA + ASVS)
 	* Update Coding Standard
 	* Design Review

 - Operations
 	* Continuous Deployment
 	* Logging
	* Monitoring
		Container
			- cAdvisor
			- heapster
			- prometheus
		Node
			- https://www.manageengine.com/network-monitoring/
			- https://www.paessler.com/prtg
			- https://www.solarwinds.com

 	* Vulnerability Management