Software Development Security
Security in the SDLC
Security requirements belong in the requirements phase; waiting until testing is the standard wrong answer. Waterfall, spiral, iterative, and agile change when risk analysis occurs. DevSecOps moves controls into the pipeline: automated scanning, infrastructure-as-code checks, signed artifacts, and policy gates. Maturity models include CMMI (process maturity), IDEAL (initiate, diagnose, establish, act), and OWASP SAMM.
Threat modeling and coding
STRIDE classifies threats as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Secure coding covers input validation, output encoding, parameterized queries, memory safety, error handling, and secrets management. Know OWASP themes conceptually: injection, broken access control, misconfiguration, vulnerable and outdated components.
Databases
ACID means atomicity, consistency, isolation, durability. Normalization reduces redundancy; denormalization trades integrity for performance. In aggregation databases the threats are inference (deducing facts from combined results) and aggregation (combining low-sensitivity data into high-sensitivity findings). Controls include cell suppression, partitioning, added noise, and polyinstantiation.
Supply chain
SBOMs, signed artifacts, dependency scanning, and vendor due diligence address third-party code risk. Repositories need access control; commit signing and peer review reduce tampering.
Worked example
An analyst interface lets users combine non-sensitive fields and deduce salaries. Adding authentication does not fix it - the flaw is inference. The control is aggregation prevention: suppress or generalize results below a threshold row count.