DerpGRC

    Topics in this domain

    Governing the Secure SDLC

    Projects and development · 1 min read

    Security at every stage

    Requirements, design, build, test, release and run, each with security activities.

    Application controls (input, processing and output controls) are defined as requirements, not afterthoughts.

    Earlier is cheaper

    Shift left: threat modelling at design, SAST at code, dependency scans at build, DAST and pen testing on the running app.

    Governance that works

    • Secure development standards, approved and trained.
    • Security requirements in every specification.
    • Gates with defined security evidence.
    • Independent review before release.
    • A software bill of materials for components.

    Example. A security flaw found in production cost 30 times more to fix than the same flaw would have cost at design. After the review, threat modelling became a mandatory design gate for all customer-facing systems.

    How the exam asks about it

    If the question asks…The answer is usually…
    MOST cost-effective time to add securityRequirements and design
    BEST way to make sure security isn’t droppedDefined gates with evidence
    Open-source componentsInventory and scan them (SBOM)
    Who approves code for releaseSomeone independent of the developer

    In short

    • Security built in during requirements and design costs far less than security added after release.
    • Each SDLC stage has security activities: requirements, threat modelling, secure coding, testing and release sign-off.
    • Application controls (input, processing, output) are defined as requirements, not afterthoughts.
    • Governance means defined standards, gates and evidence, not just good intentions.
    • Third-party and open-source components need the same scrutiny as in-house code.

    Exam traps

    • Penetration testing just before go-live as the only security activity.
    • No security requirements in the original specification.
    • Ignoring open-source and third-party libraries.
    • Developers approving their own code for release.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 4 · Projects and development

    Governing the Secure SDLC

    How security and control requirements are built into each stage of the system development life cycle, and the governance that makes sure they don't get dropped.

    1 / 7