{
  "uid": "cogitave.learn.secure-sdlc.introduction",
  "kind": "moduleUnit",
  "href": "/modules/secure-sdlc/introduction/",
  "title": "Introduction",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "What you will get from this module"
  ],
  "source": "Security bolted on after design is the most expensive and least effective place\nto add it. Cogitave's answer is to make security a **design property produced by\na lifecycle** - decided at the requirements and design phase, then enforced by a\ngate at every stage a change moves through, all the way to how a vulnerability is\nremediated after release.\n\nTwo standards carry this, and they divide cleanly:\n\n- The [Security Standard](../../../../standards/docs/standards/security.md) owns\n  the **controls** - identity and access management, secrets and PKI, security\n  operations, and threat modeling as a named activity. It is load-bearing for\n  certification (ISO 27001 / SOC 2).\n- The [Secure Development Lifecycle Standard](../../../../standards/docs/standards/secure-development-lifecycle.md)\n  owns the **process** that yields secure software: where each gate fires, when a\n  threat model is mandatory, and how vulnerabilities are triaged to closure. It\n  does not restate controls; wherever it names one, `security.md` is\n  authoritative.\n\nThe decision to couple these - security-by-design with STRIDE threat modeling by\ndefault, an ASVS baseline, and CVSS/EPSS remediation SLAs - is recorded in\n[ADR 0020](../../../../standards/docs/decisions/0020-reliability-and-secure-sdlc.md).\n\n> [!IMPORTANT]\n> The point of the lifecycle is **shift-left**: the earlier a class of defect is\n> caught, the cheaper it is to fix. Security adds **no new pipeline** - it names\n> which security activity each stage of the request lifecycle you already work\n> owns, and which existing gate enforces it.\n\n## What you will get from this module\n\nFirst, the **security baseline** - the controls a Cogitave product is built on:\nthreat modeling, least privilege, and IAM for humans, workloads, and agents.\nThen the **secure development lifecycle** - how those controls become a gate at\neach stage, when a threat model cannot be waived, and what blocks a merge. You\nwill finish able to build with the secure SDLC rather than treat security as\nsomeone else's end-of-line review.\n",
  "partOf": "cogitave.learn.secure-sdlc",
  "durationInMinutes": 4,
  "quiz": null
}