Security Teams Need Pipelines Too
Security teams are good at asking development teams hard questions. Who reviewed this change? What tests passed? Which dependencies are present? Where is the software bill of materials? ... Those are fair questions. They should also be pointed back at us.
Read next
Break-Glass Access That Does Not Quietly Become Normal Access
A practical design for emergency access that remains independent, time-bounded, observable, testable, and difficult to normalize into an ordinary administration path.
Proving Least Privilege with Denial Tests
Least privilege is not proved by showing that approved work succeeds. It is proved by testing the nearby actions, resources, identities, and conditions that policy must deny.