Question

A development team has adopted a DevOps model that releases code to production multiple times per day through an automated CI/CD pipeline. The information security manager finds that the existing manual security review, which occurred once per release cycle, can no longer keep pace and is being bypassed to meet delivery deadlines. Which approach BEST enables security to remain effective in this environment?

Accepted Answer

Integrate automated security testing tools directly into the CI/CD pipeline so scans run as part of the build process

Answer

Reinstate the manual security review as a mandatory gate before every production deployment

Answer

Schedule quarterly penetration tests of the production environment to catch accumulated vulnerabilities

Answer

Require developers to complete additional secure coding training before pipeline access is granted