Integrating security into the development process is critical for the proper functioning of an application. API gateways, RBAC systems, and service mesh sidecars can all provide some elements of security, but the final arbiter of who can do what and under what circumstances must be the responsibility of the domain model. One critical aspect of application security is being able to test the application’s security constraints as part of the normal domain logic, and asserting about it as part of a simple, on-workstation test suite without recourse to external API gateways or other access control mechanisms. In this talk, you’ll get a look at how to embed security in domain models, allowing for developers to take greater responsibility for integrating security into the core of our applications. You’ll see some patterns for coarse- and fine-grained access control as well as complex business rules about who may do what to which entity, when, and under what circumstances.
Author Name: DevSecCon
Author Description:
DevSecCon is the global community dedicated to DevSecOps to help implement security in the overall development process. If you’re a security enthusiast & you want to learn more about how to better secure your team, then check out our community & resources.

Table of Contents

• Domain Models: Security as a First-class Concern
  36mins