Delivery and Security

Published on August 17, 2023

Secure delivery is a system of feedback loops rather than a sequence of scanners. A change moves from intent to source, build, test, artifact, deployment, and operation. Each stage should produce evidence, reduce a known risk, and preserve enough context to diagnose failure.

Follow the lifecycle

1. Plan: establish requirements, risk, data use, ownership, and acceptance criteria.
2. Code: review changes, detect exposed secrets, and apply language-aware analysis.
3. Build: produce reproducible artifacts and account for dependencies and provenance.
4. Test: build confidence at the cheapest effective layer and test security properties.
5. Release: promote an immutable, identifiable artifact with its evidence.
6. Deploy: control exposure, verify outcomes, and retain a recovery path.
7. Operate: own service health, change, access, capacity, and recovery.
8. Monitor: turn telemetry into user-impact and risk decisions.

Design controls around risk

Avoid adding a tool without naming the failure it detects, its expected signal quality, and the action attached to a result. Fast checks belong close to the developer. Expensive integration or dynamic checks can run later, provided they do not become an unbounded release queue.

The DevOps path covers delivery flow and software-supply-chain architecture. Security and Compliance in Infrastructure develops control ownership and evidence in more depth.