Course 7 - Secure SDLC (Software Development Life Cycle) | Episode 1: Approaches, Eight Phases, and Risk Management | CyberCode Academy

In this lesson, you’ll learn about: Secure Software Development Life Cycle (Secure SDLC) — Full Overview

Definition of Secure SDLC
- A framework that integrates security into every phase of system development:
  Planning → Design → Build → Validation → Deployment → Maintenance
Why Secure SDLC Matters
- Rising security concerns: DDoS, account takeover, OWASP Top 10
- Managing business risks such as breach penalties
- Achieving GRC (Governance, Risk Management, Compliance) with PCI DSS, HIPAA, GDPR/CCPA
- Enabling the Shift Left strategy to catch gaps early and reduce cost, time, and effort later

Approaches to Secure SDLC

Proactive Approach (for new systems)
- Preventing and protecting against known threats in advance
- Securing code and configurations early in the development process
Reactive Approach (for existing systems)
- Detecting and stopping threats before exploitation or breach
- Acting as a corrective control

The Eight Secure SDLC Phases

Awareness Training
- Regular security training, phishing exercises, and compliance awareness
- Note: 93% of successful breaches begin with phishing
Secure Requirements
- Planning phase to define and continuously update security requirements based on functionality and GRC expectations
Secure Design
- Architectural phase to establish secure requirements
- Selecting appropriate secure design principles and patterns
Secure Build
- Implementation phase focused on building secure systems
- Using standardized, repeatable components
- Applying Static Application Security Testing (SAST)
Secure Deployment
- Ensuring security and integrity during the deployment process
- Emphasizing automation and protecting sensitive data (passwords, tokens)
Secure Validation
- Validating artifacts through security testing such as:
  Dynamic Application Security Testing (DAST), fuzzing, penetration testing
Secure Response
- Operations and maintenance
- Executing the incident response plan
- Active monitoring and responding to threats to maintain Confidentiality, Integrity, and Availability (CIA)
Collaborative Model
- An approach used to solve security issues in enterprise or distributed environments
- Involves collaboration among development, security, QA, and operations

Secure SDLC Snapshot & Performance View

Risk Management & Threat Analysis Impact Study

Threats:
- Possible dangers (intentional or accidental) like hacking, natural disasters, phishing, password theft, shoulder surfing, and email malware
Security Incidents:
- Events where information assets are accessed, modified, or lost without authorization
Vulnerabilities:
- Weaknesses that threats may exploit
Impact:
- Outcome of threats and incidents

Risk Analysis & Scoring (NIST Representation)

Risk = Likelihood × Impact
Likelihood depends on:
- Threats, incident history, ease of discovery, and ease of exploit
Impact includes:
- Technical Impact: Loss of confidentiality, integrity, availability, accountability
- Business Impact: Financial loss, reputation damage, non-compliance, privacy violations
Example:
- Stored XSS = higher likelihood & higher impact
- Reflected XSS = lower likelihood & moderate impact

Taxonomy of an Incident

Classification includes:
- Attackers
- Tools used
- Vulnerabilities targeted
- Actions performed
- Unauthorized impact (information disclosure, DoS, manipulation)
- Objectives (financial gain, challenge, disruption)

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 7 - Secure SDLC (Software Development Life Cycle) | Episode 1: Approaches, Eight Phases, and Risk Management