# Security in Cloud-Native Services: A Survey
## 6 Secure Software Development Lifecycle (SDLC)
### Security Risk Profiling and Mitigation  
To mitigate such risks, it is essential to implement robust security measures throughout the application development lifecycle. These measures may include using secure coding practices, regularly patching and updating open-source libraries, performing vulnerability assessments [133], penetration testing, implementing access controls, and using security tools such as intrusion detection and prevention systems. There are some specific things one can do to improve security posture. Firstly, one can add some security gateways between the development stages to help catch earlier vulnerabilities, as depicted in Figure 7. By scanning the code for security issues at different stages of the SDLC and detecting security vulnerabilities early, security issues can be addressed before they become more difficult and expensive to fix. Automated security checks can be set up to reduce the manual effort required for security testing and allow developers to focus on other critical tasks. Finally, security gateways can be integrated with other tools in the SDLC, such as static analysis tools, continuous integration, and continuous deployment tools that can help create a more streamlined and automated security process. Figure 6: Modern application stack and risk profile. The examination of the modern application risk profile presented in Figure 6, assists towards elaborating more on each layer's specific security measures. **Application Code:** Static Application Security Testing (SAST) [134] methodologies can be used to identify security vulnerabilities in the source code of an application (custom code). SAST tools, depicted in Figure 8 can be run using the editor or an Integrated Development Environment (IDE) to scan the application's source code, looking for common vulnerabilities such as SQL injection, cross-site scripting (XSS), buffer overflows, and other security issues. SAST tools use pattern-matching and rule-based techniques to identify security vulnerabilities in the source code. During a SAST scan, the tool generates a report listing all the security vulnerabilities found in the source code. The report includes details on the location of the vulnerability, the type of vulnerability, and recommendations on how to fix the issue. SAST is also useful for enforcing secure coding practices and standards, as the tool can identify code that does not adhere to best practices and provide recommendations for improvement. **Open Source Libraries:** Nowadays, applications often rely on numerous dependencies and third-party libraries. Each of them increases the security risk of the application. Software Composition Analysis (SCA) [135] is an approach to identify any vulnerabilities, bugs, or other potential issues that could affect the application's overall performance. SCA, depicted in Figure 9, is ideal for analyzing open-source or third-party integrations and their dependencies to ensure that they do not introduce any security risks. Figure 8: Static Application Security Testing (SAST). Figure 7: Secure SDLC. SCA tools can automate the analysis process and provide developers with detailed reports on the quality and security of their software components. These tools can also provide recommendations for improving the overall quality and security of the software application. SCA tools can significantly simplify the process by referencing the Common Vulnerabilities and Exposures (CVE) database [136], which is essentially a standardized list of publicly known vulnerabilities and security issues. Each CVE entry provides a unique identifier, a brief vulnerability description, and any relevant references and solutions. Moreover, it is essential to ensure any third-party or open-source packages are actively being used and maintained by the community. Lastly, tools such as WhiteSource Bol or Black Duck are pivotal in searching for known vulnerabilities [137]. Again, their scope is typically narrowed to the search of issues in databases of known vulnerabilities.