{
  "uid": "cogitave.learn.secure-sdlc.the-secure-development-lifecycle",
  "kind": "moduleUnit",
  "href": "/modules/secure-sdlc/the-secure-development-lifecycle/",
  "title": "The secure development lifecycle",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "A gate at each stage",
    "The threat model is the core process",
    "Verify, remediate, and honesty"
  ],
  "source": "Security shifts **left** into the existing request lifecycle. The\n[Secure Development Lifecycle Standard](../../../../standards/docs/standards/secure-development-lifecycle.md)\nadds no new pipeline - it names which security activity each stage owns and which\n**existing** gate enforces it, so every stage of a change carries its own gate.\n\n## A gate at each stage\n\n| Lifecycle stage | Security activity | Enforced by |\n| --- | --- | --- |\n| Requirements | Security requirements + abuse cases; ASVS baseline selected | Definition of Done; security-triage |\n| Design | **Threat model** - DFD + trust boundaries + STRIDE register, reviewed before code | RFC/ADR Accepted; DoD **S1** |\n| Implement | Secure-coding rules; pre-commit **SAST** + **secret-scan** block on critical/secret | CI + pre-commit hooks |\n| Verify | Full security test tier: SAST/SCA/DAST/IAST/fuzz | testing-quality; DoD **S2** |\n| Release | SBOM generated + artifact signed + provenance | supply-chain (SLSA/SBOM/cosign) |\n| Respond | Continuous monitoring; vulnerability-management SLAs; postmortem | observability; incident response |\n\nThe threat-model gate (**S1**) and the no-new-high-or-critical gate (**S2**) are\nthe two Definition-of-Done security items - the checks that make the lifecycle\nenforceable per change.\n\n## The threat model is the core process\n\nThe **default** method is **STRIDE over a data-flow diagram** with explicit trust\nboundaries. Four questions drive every session: *what are we building, what can go\nwrong, what are we going to do about it, did we do a good enough job?* The output\nis a living **threat register** - threat, affected element, STRIDE class,\ndecision, mitigation, owner, status - committed beside the design, not a slide\ndeck.\n\nA threat model is **mandatory** (DoD S1 cannot be waived) when the request is\ndesign-class, introduces or moves a **trust boundary** (a new external interface,\nauthn/authz path, tenant boundary, or agent capability edge), or adds a new store\nof personal or secret data, a new third-party integration, or a new **agent or\nLLM** surface. It is reviewed at the design gate, **before implementation** - a\nthreat model produced after code is a process failure.\n\n## Verify, remediate, and honesty\n\nThe security **test tiers** each run at a defined gate: SAST, secret scan, SCA,\nand IaC/container scan are **required**; **fuzz** is required for parsers and\nprotocol handlers. Pentest and red-team are marked **target**, not a present-day\nclaim - Day-0 honesty for a small remote team.\n\nFindings flow into one vulnerability lifecycle with SLAs by CVSS severity:\nCritical 24-48h, High 7 days, Medium 30 days, Low 90 days. A finding with **EPSS\n> 0.5** or on the CISA **KEV** list is elevated one severity tier - probable\nreal-world exploitation outranks the raw base score. **No new High or Critical**\ndependency (SCA) finding may merge; that is the DoD S2 tie.\n\n> [!IMPORTANT]\n> Security is an **automated gate owned by the builders**, not a separate team\n> that reviews work at the end. A developer-led Security Champions program owns\n> the code-review security gate; the security function sets policy and handles\n> high-risk reviews rather than gating every PR.\n\nFor agent and LLM surfaces the **OWASP Top 10 for LLM Applications** is\nfirst-class in the threat model: prompt injection is the default assumption - all\nexternal and tool content is **untrusted data, never instructions** - and\ntoken-budget, recursion, and timeout caps are required on every agent loop to\nbound denial of service.\n",
  "partOf": "cogitave.learn.secure-sdlc",
  "durationInMinutes": 8,
  "quiz": null
}