c2.20 Involve security teams early in development
Security and development teams should work together from day one, so applications are designed with security in mind rather than having it bolted on right before launch.
Implementation guidance
Bring security into the design phase
Applications are built securely when security teams engage early — during design and the first prototype — not one minute before the production deploy. Late criticism of developers builds friction, not a working relationship. Plan the protections each application needs from the start, and make the security team easy for developers to reach with questions.
Make the collaboration proactive
- Include a security representative in architecture and design decisions.
- Provide security best-practice guidance to developers early, before code is written.
- Run application security reviews well ahead of the launch date, not at the last minute.
Related
This foundation grows into Security Champions and DevSecOps in later phases.
How to validate
- Is your security team working with developers proactively or reactively?
- Is a security representative involved in the design phase and architectural decisions?
- Does security provide best-practice guidance early and run reviews well before launch?
- Is the security team easily reachable for developers’ questions?
Threats addressed
- When security engages late, vulnerabilities reach production because there is no time left to remediate — and exposed web applications become an entry point for adversaries.