Pentester here, ~10 years experience. My specialty is crystal-box security, as in, pentesting with the source code, so I've seen many codebases and I've seen many companies trying to secure their development process. In recent years more companies are trying to develop "secure by design", also called "shift-left" or "build-security-in". The main issue is that software is complex. If you have a simple CRUD API, you can actually make it very secure quite easily. But real systems are made up of many components, which are constantly developing. So even if you make a system that's secure today (you secure it by design), management is going to wake up tomorrow with some hip use case that doesn't fit your initial design, and you have to hack some stuff together to make it work. You never have the time to go back to the drawing board and build a perfect design around the new situation. It's just like building the right abstraction layers. It will be tight in the beginning, then you develop, and at some point you need to refactor to make it tight again. But there is only so much time you can spend on it, so you're behind on the facts. On top of that you have a landscape of applications that interact with each other, which are all developing, so most of the time there is no one that can oversee it all. Architects just draw abstractions; they don't understand the system on the code level. I don't agree with the statement that security costs more or slows the process. Proper security design should help you to create more structure and clarity. Better structure should allow for quicker development. Doing Threat Modeling helps you understand the application better. This in turn should help you restructure your code. If it's not an addition to your development process, you're not doing it right. Some awful trends are: just Googling "how do I do DevOps security" to just cram a bunch of tools in the pipeline. They buy some scan tool that scans for outdated packages and they dump a list of 1000 findings in the developer mailbox. They take bullshit governance-stuff from the policy documents and make a checklist from it, causing massive overhead while adding little to the actual security process. The list goes on and on. More on reddit.com

I would hate to be your developers. That shit is going to be slow as fuck. Programmer time > hardware costs. More on reddit.com

I highly recommend grabbing a free pdf online of the owasp secure code review guide and reading up on owasp top 10, that’ll be a great reference to help you keep security best practices in mind when you’re coding. Make sure you’re not using outdated libraries, sanitize inputs, if you’re using sql utilize parameterized queries, etc. More on reddit.com

The industry standard would be something similar to the Secure Software Development Framework (NIST SP 800-218) . You will see four groups (Prepare the Organization, Protect the Software, Produce Well-Secured Software, Respond to Vulnerabilities) and for each one of these groups you will have best-practices and associated tasks. You will also find multiple references related to each one of the practices. More on reddit.com