How do you balance speed and quality in agile SDLC without compromising security?

Before even writing one line of code - SDLC starts with requirements an then architecture & design. So security needs to be embedded from the start including secure architecture, secure design. Architecture & design proposals need to a section called out to outline Prevention & Detection mechanisms - Eg. Logging, Alerting.

Agreed. Furthermore, at the root of the need for speed is the organization's commitment to ensuring it also has a security mindset. This isn't just the role of engineers and architects, it's the entire organization recognizing that as a whole, the majority of products that touch the market have inherent risk and the org needs to be committed to risk mitigation. That includes product, project, quality assurance, and those driving the direction.

Top-level management commitment is key to a strong SDLC, this is written in a few industry standards and frameworks (ISO/SAE 21434, NIST SP800-218). It needs to be acknowledged from the top down in the organization.

Tell me how you are going to measure me and I will show you how I will behave. If engineering leaders need to be held accountable for managing the risk posture of the software their teams write.

One more dimension to think about is the infrastructure on which the code will be deployed. Secured code & secured infrastructure are two main pillars of security.

Security at scale can achieved much more efficiently through automation. Invest into building automation in all the areas mentioned above. and then have a well defined risk-based methodology to know when the automation would need to alert & allow Vs alert & block.

Adding security as an acceptance criteria alongside quality and at the user stories level, needs to be well thought out before rolling it out across the whole product backlog. When introducing it initially, it will slow down the release process, but will reap benefits in the medium to long term. There needs to be a balance so its not onerous on the development velocity and at the same time it doesn't become a low value-add checkbox task.

👉Both OWASP and SANS25 are best industry examples to tell on what are the latest industry security vulnerabilities. 👉It is highly recommended to follow code best practices to avoid security issues but not all the issues can be discover-able hence scanning code in frequent CI methods are highly recommended!