Information security requirements should be identified, specified and approved when developing or acquiring applications.
Code is scanned for code-level vulnerabilities, weak authentication patterns, and OWASP Top 10 flaws. Container images are continuously scanned for misconfigurations.
All application events, errors, and security-relevant activities are logged centrally. Prometheus and Grafana collects and visualizes resource metrics effectively.
All application code is developed following defined security requirements, including proper access control and authorization checks. We use Test-Driven Development (TDD) and comprehensive use-case testing to validate both expected and negative scenarios (e.g., ensuring access is denied when it should be).