| Security issues, like other emergent system properties, can arise at any layer of the stack. While code level issues should absolutely be a focus in the SDLC, it's common to find security issues crop up from: * Hardware, kernel, OS, package, and library vulnerabilities * Component integration / API contract misunderstandings * Transitive trust between services and third parties * Accumulation of access over time * Demos, hotfixes, and workarounds that are somehow now mission critical |