Secure-by-Design: Embedding Cybersecurity in Microsoft Cloud Application Lifecycle Management

References

[1] Abhijeet Ashok Kupale, P. S. Powar. (2023). Empowering Critical Business Functions: Azure DevOps for Accelerate Software Development Life Cycle Management. International Journal of Research Publication and Reviews, Vol 4, no 11, pp 588-592

[2] Adedamola Abiodun Solanke. (2022). Enterprise DevSecOps: Integrating security into CI/CD pipelines for regulated industries. World Journal of Advanced Research and Reviews, 2022, 13(02), 633-648. https://doi.org/10.30574/wjarr.2022.13.2.0121

[3] Aggrey, Richard & Cudjoe, Afeti & Osei Afoduo, Karl & Eyeson, Jessica & Adjei, Bright & Dsane Phd, Nana Adwoa. (2025). Cloud Security Best Practices: Strategic Measures to Protect Digital Assets Within the Cloud. International Journal For Multidisciplinary Research. 7. 18. 10.36948/ijfmr.2025.v07i01.35156.

[4] Ali-Amin. (2021). Develop Frameworks for Integrating Automated Security Testing and Compliance Checks Throughout the Software Development Lifecycle. SSRN Electronic Journal. 9. 312-321.

[5] AlphaZetta. (2023). Principles of Secure by Design. Retrieved July 9, 2025, from https://alphazetta.ai/news/principles-of-secure-by-design/

[6] Aremu Oluwaferanmi. (2025). Dynamic Application Security Testing (DAST) and Interactive Application Security Testing (IAST).

[7] Atmosera. (2024). Atmosera managed Azure solution for Keona Health. Atmosera. https://www.atmosera.com/resources/case-study/atmosera-managed-azure-solution-for-keona-health/

[8] Barnty, Barnabas. (2025). The Role of Software Testing in Agile and DevOps Environments. https://www.researchgate.net/publication/390627132_The_Role_of_Software_Testing_in_Agile_and_DevOps_Environments

[9] Bondalapati RC and Malaraju SK (2025) Enhancing Secure Deployment Automation in Cloud Environments: A Risk-Driven Approach to CI/CD Pipelines, European Journal of Computer Science and Information Technology,13(38),60-75. doi: https://doi.org/10.37745/ejcsit.2013/vol13n386075

[10] Booth H, Souppaya M, Vassilev A, Ogata M, Stanley M, Scarfone K (2024) Secure Development Practices for Generative AI and Dual-Use Foundation AI Models: An SSDF Community Profile. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-218A. https://doi.org/10.6028/NIST.SP.800-218A

[11] Borra, Praveen. (2024). Maximizing Efficiency and Collaboration with Microsoft Azure DevOps. International Journal of Advanced Research in Science Communication and Technology. 4. 556-562. 10.48175/IJARSCT-18864.

[12] CrowdStrike. (2023). Security as Code. Retrieved July 11, 2025, from https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/security-as-code/

[13] Cybersecurity and Infrastructure Security Agency. (2023). Shifting the balance of cybersecurity risk: Principles and approaches for secure by design and default. Retrieved July 9, 2025, from https://www.cisa.gov/sites/default/files/2023-04/principles_approaches_for_security-by-design-default_508_0.pdf

[14] Dedicatted. (2024). Enabling security compliance and DevOps agility in a regulated healthcare environment. Retrieved July 11, 2025, fromhttps://dedicatted.com/insights/enabling-security-compliance-and-devops-agility-in-a-regulated-healthcare-environment

[15] Devtron. (2022). CI build pre/post plugins. Retrieved July 10, 2025, from https://docs.devtron.ai/devtron/v0.4/devtron/user-guide/creating-application/workflow/ci-pipeline/ci-build-pre-post-plugins

[16] Elijah, Samuel & Moore, Elizabeth & Hocine, Bouchra. (2025). Securing the Multi-Cloud Era: The Need for Unified Security Management Solutions.

[17] Exult Global. (2025). Microsoft Purview: Redefining data governance and compliance. Retrieved July 11, 2025, from https://www.exultglobal.com/post/microsoft-purview-redefining-data-governance-and-compliance#:~:text=Microsoft%20Purview%20is%20an%20end,%2C%20cloud%2C%20and%20hybrid%20environments.

[18] Faqih, Adam & Taufiqurrahman, Alif & Husen, Jati & Sabariah, Mira. (2024). Empirical Analysis of CI/CD Tools Usage in GitHub Actions Workflows. Journal of Informatics and Web Engineering. 3. 251-261. 10.33093/jiwe.2024.3.2.18.

[19] Folorunso, Adebola & Wada, Ifeoluwa & Samuel, Bunmi & Mohammed, Viqaruddin. (2024). Security compliance and its implication for cybersecurity. World Journal of Advanced Research and Reviews. 24. 2105-2121. 10.30574/wjarr.2024.24.1.3170.

[20] Gabrail, S. (2023). Which IaC scanning tool is the best? Comparing Checkov vs tfsec vs Terrascan. Retrieved July 10, 2025, from env0 Blog

[21] Galij, S., Pawlak, G., & Grzyb, S. (2024). Modeling Data Sovereignty in Public Cloud—A Comparison of Existing Solutions. Applied Sciences, 14(23), 10803. https://doi.org/10.3390/app142310803

[22] Google Cloud. (n.d.). FedRAMP compliance. Retrieved July 10, 2025, from https://cloud.google.com/security/compliance/fedramp

[23] IBM. (2024). Audit and compliance practices in z/OS DevOps workflows. Retrieved July 11, 2025, from https://www.ibm.com/docs/en/z-devops-guide?topic=practices-audit-compliance

[24] IBM. (2024). Cost of a data breach 2024: Financial industry. Retrieved July 9, 2025, from IBM Think Insights

[25] Jani, Yash. (2023). IMPLEMENTING CONTINUOUS INTEGRATION AND CONTINUOUS DEPLOYMENT (CI/CD) IN MODERN SOFTWARE DEVELOPMENT. International Journal of Science and Research (IJSR). 12. 2984-2987. 10.21275/SR24716120535.

[26] Joshi, Nikhil Yogesh. (2024). INFRASTRUCTURE AS CODE (IAC) AND DATA CENTRE MIGRATIONS: AUTOMATING INFRASTRUCTURE FOR SCALABILITY AND RELIABILITY. International Journal of Innovation Studies. 8. 617.

[27] Koneru, Naga. (2021). Integrating Security into CI/CD Pipelines: A DevSecOps Approach with SAST, DAST, and SCA Tools. International Journal of Science and Research Archive. 3. 250-265. 10.30574/ijsra.2021.3.1.0080.

[28] Manolov, V., Gotseva, D., & Hinov, N. (2025). Practical Comparison Between the CI/CD Platforms Azure DevOps and GitHub. Future Internet, 17(4), 153. https://doi.org/10.3390/fi17040153

[29] Mark Terry. (2022). Microsoft Azure Sentinel – The CyberOne Guide. Retrieved July 11, 2025, from CyberOne https://cyberone.security/resources/microsoft-azure-sentinel-guide?hs_amp=true

[30] Mass, Flix & Chris, Mercy & Man, Holla & Andrewson, Susan & Hoover, Rose. (2025). Cross-Functional Team Structures that Promote DevOps Success Author.

[31] Microsoft. (2022). Gjensidige builds on GitHub and Azure to put security front-and-center in new application platform. Retrieved July 11, 2025, from https://www.microsoft.com/en/customers/story/1465446566409467680-gjensidige-insurance-azure-github

[32] Microsoft. (2022). Threats – Microsoft Threat Modeling Tool. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats

[33] Microsoft. (2023). Microsoft Sentinel: SIEM and XDR for modern security operations. Retrieved July 11, 2025, from https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-sentinel

[34] Microsoft. (2023). Overview of Azure Blueprints. Retrieved July 11, 2025, from https://learn.microsoft.com/en-us/azure/governance/blueprints/overview

[35] Microsoft. (2023). Infrastructure as Code considerations. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code

[36] Microsoft. (2023). Threat modeling for drivers. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/windows-hardware/drivers/driversecurity/threat-modeling-for-drivers

[37] Microsoft. (2024). Microsoft Digital Defense Report 2024. Retrieved July 9, 2025, from Microsoft Security Insider

[38] Microsoft. (2024). What is Microsoft Defender for Identity? Retrieved July 11, 2025, from https://learn.microsoft.com/en-us/defender-for-identity/what-is

[39] Microsoft. (2024). Microsoft Security Development Lifecycle (SDL). Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/compliance/assurance/assurance-microsoft-security-development-lifecycle

[40] Microsoft. (2024). Security development and operation assurance. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/compliance/assurance/assurance-security-development-and-operation

[41] Microsoft. (2025). Configure agentless code scanning (Preview) - Microsoft Defender for Cloud. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning

[42] Microsoft. (2025). Design Azure Policy as Code workflows. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-as-code

[43] Microsoft. (2025). Learn about Microsoft Purview. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/purview/purview

[44] Microsoft. (2025). Microsoft Defender for Cloud overview. Retrieved July 11, 2025, from https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

[45] Microsoft. (2025). Overview of Azure Policy. Retrieved July 11, 2025, from https://learn.microsoft.com/en-us/azure/governance/policy/overview

[46] Microsoft. (2025). Overview of partner integration - Microsoft Defender for Cloud. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/azure/defender-for-cloud/partner-integrations

[47] Microsoft. (2025). Require MFA for all users with Conditional Access - Microsoft Entra ID. Retrieved July 11, 2025, from https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength

[48] Microsoft. (2025). Scan your connected GitHub repository or Azure DevOps project. Retrieved July 10, 2025, from https://learn.microsoft.com/en-us/azure/defender-for-cloud/iac-vulnerabilities

[49] Microsoft. (2025). Set up code scanning with GitHub Advanced Security for Azure DevOps. Retrieved July 11, 2025, from https://learn.microsoft.com/en-us/azure/devops/repos/security/github-advanced-security-code-scanning?view=azure-devops

[50] Microsoft. (2025). Securing your data with Microsoft Purview: A practical handbook. Retrieved July 11, 2025, from https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Securing-your-data-with-Microsoft-Purview.pdf/

[51] Microsoft. (2025). What is cloud security? Retrieved July 11, 2025, from https://www.microsoft.com/en-us/security/business/security-101/what-is-cloud-security

[52] Microsoft Security. (2025). Securing your data with Microsoft Purview. Retrieved July 10, 2025, from https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Securing-your-data-with-Microsoft-Purview.pdf/

[53] Mukaj, Jon. (2023). Containerization: Revolutionizing Software Development and Deployment Through Microservices Architecture Using Docker and Kubernetes. 10.13140/RG.2.2.23804.51841.

[54] Özdoğan, Erdal & Ceran, Onur & ÜSTÜNDAĞ, Mutlu. (2023). Systematic Analysis of Infrastructure as Code Technologies. Gazi University Journal of Science Part A: Engineering and Innovation. 10. 10.54287/gujsa.1373305.

[55] Potla S. (2025) Threat Modeling in Application Security: A Practical Approach, European Journal of Computer Science and Information Technology,13(30),10-19. doi: https://doi.org/10.37745/ejcsit.2013/vol13n301019

[56] Sandu, Arun Kumar. (2021). DevSecOps: Integrating Security into the DevOps Lifecycle for Enhanced Resilience. 6. 1-19.

[57] Sanin, O. Y. (2024). Data-driven feedback loops: How DevOps and data science inform product iterations. Retrieved July 11, 2025, from https://devops.com/data-driven-feedback-loops-how-devops-and-data-science-inform-product-iterations/#google_vignette

[58] SentinelOne. (2025). 50+ cloud security statistics in 2025. Retrieved July 9, 2025, from SentinelOne

[59] SentinelOne. (2025). Entra ID: Key features, security, and authentication. Retrieved July 11, 2025, from https://www.sentinelone.com/cybersecurity-101/identity-security/entra-id/

[60] SentinelOne. (2025). How to perform cloud compliance audit? Retrieved July 11, 2025, from https://www.sentinelone.com/cybersecurity-101/cybersecurity/how-to-perform-cloud-compliance-audit/

[61] Somi, Vivek. (2024). A Comparative Analysis and Benchmarking of Dynamic Application Security Testing (DAST) Tools. Journal of Engineering and Applied Sciences Technology. 1-6. 10.47363/JEAST/2024(6)E139.

[62] Talan. (2023). Microsoft Defender for DevOps: Bridging security and development. Retrieved July 10, 2025, from https://blog.talan.com/2023/02/13/microsoft-defender-for-devops/

[63] Tatineni, Sumanth. (2023). COMPLIANCE AND AUDIT CHALLENGES IN DEVOPS: A SECURITY PERSPECTIVE. 10.56726/IRJMETS45309.

[64] Thatikonda, Kalyan Chakravarthy. (2025). A Comprehensive Analysis of AI-Enhanced DevSecOps in Strengthening Distributed Systems Security and Compliance. International Journal of Scientific Research in Computer Science, Engineering and Information Technology. 11. 10.32628/CSEIT25112449.

[65] U.S. Department of Health & Human Services. (2024). HIPAA Security Rule. Retrieved July 10, 2025, from https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

[66] UST. (2024). Leading asset management firm successfully migrates applications from external data center to Azure cloud. Retrieved July 11, 2025, from https://www.ust.com/en/insights/leading-asset-management-firm-successfully-migrates-applications-from-external-data-center-to-azure-cloud

[67] UST. (2024). Multinational insurance company migrates to the cloud and embraces DevSecOps. Retrieved July 11, 2025, from https://www.ust.com/en/insights/multinational-insurance-company-migrates-to-the-cloud-and-embraces-devsecops

[68] Wessel, M., Vargovich, J., Gerosa, M.A. et al. (2023). GitHub Actions: The Impact on the Pull Request Process. Empir Software Eng 28, 131 (2023). https://doi.org/10.1007/s10664-023-10369-w

[69] Zhu, Jingyun & Li, Kaixuan & Chen, Sen & Fan, Lingling & Wang, Junjie & Xie, Xiaofei. (2024). A Comprehensive Study on Static Application Security Testing (SAST) Tools for Android. 10.48550/arXiv.2410.20740.

@article{1713009,
      author = {Omotayo Adebola Musbaudeen},
      title = {Secure-by-Design: Embedding Cybersecurity in Microsoft Cloud Application Lifecycle Management},
      journal = {Iconic Research And Engineering Journals},
      year = {2025},
      volume = {9},
      number = {6},
      pages = {1753-1768},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1713009.pdf},
      abstract = {As organizations accelerate digital transformation, the security of cloud-native applications has become a national and enterprise priority. This article critically explores the Secure-by-Design paradigm within the Microsoft cloud ecosystem, emphasizing how DevSecOps methodologies, integrated toolchains, and regulatory frameworks converge to embed cybersecurity from code inception to production deployment. Anchored in the principles of least privilege, defense in depth, and secure defaults, Secure-by-Design offers a scalable blueprint for mitigating the risks of cyber threats in Azure and Microsoft 365 environments. Through case studies, the paper highlights practical implementations of GitHub Advanced Security, Microsoft Defender for Cloud, Azure Policy, and Purview to enforce compliance, identity protection, and continuous threat monitoring. It further examines the cultural, technical, and geopolitical challenges in secure cloud adoption and offers strategic recommendations for enterprises and national cybersecurity stakeholders. Finally, this study reaffirms that embedding security across the application lifecycle is a best practice as it serves as an essential to safeguarding critical infrastructure in an era of increasingly complex digital threats.},
      keywords = {Secure-by-Design, DevSecOps, Microsoft Azure, GitHub Advanced Security, Microsoft Defender for Cloud, Infrastructure-as-Code (IaC), Cybersecurity Resilience, Compliance Automation, Secure Cloud Migration, Identity Protection, Application Lifecycle Security},
      month = {December},
  }