DevSecOps Pipeline – Plan Stage
The Plan stage is where security is cheapest to apply and easiest to skip. This domain tests threat modelling, security requirements, abuse cases, risk treatment and compliance scoping performed before code exists.
Core rules
- Threat modelling happens during design, not after architecture sign-off. The standard method is: decompose the system (data flows, trust boundaries, entry points), identify threats, rank them, and decide mitigate / transfer / avoid / accept.
- STRIDE gives a checklist: Spoofing (authentication), Tampering (integrity), Repudiation (non-repudiation/logging), Information disclosure (confidentiality), Denial of service (availability), Elevation of privilege (authorisation).
- Abuse cases and security user stories put misuse into the backlog with acceptance criteria, so security work is estimated and scheduled like any other story.
- Data classification drives controls: identifying regulated data at plan time determines encryption, retention and residency requirements.
- Policy as code authoring starts here - the rules the pipeline will enforce are written and reviewed alongside the design.
- Definition of Ready/Done should include threat model reviewed, data classification recorded, and security acceptance criteria met.
Worked example
A team designs a password reset flow with a tokenised email link. Threat model: Spoofing - attacker guesses a reset token → mitigate with ≥128-bit random token, single use, 15-minute expiry. Information disclosure - token leaked via referrer header → set Referrer-Policy and avoid embedding in URLs shown to third parties. Tampering - user ID in the request body manipulated → derive identity from the token, never from a client-supplied field. Denial of service - reset endpoint flooding → rate limit per account and per IP. Elevation of privilege - reset succeeds without second factor on privileged accounts → require MFA re-verification. Each mitigation becomes an acceptance criterion the build stage can verify.
Traps that cost marks
- Threat modelling after the architecture is frozen - the exam treats this as a control failure.
- Mixing up STRIDE letters: Tampering is integrity of data, Repudiation is deniability of an action.
- Recording a compliance checkbox as a risk decision; risk acceptance needs an owner, rationale and expiry.
- Omitting non-functional security requirements (logging, retention, latency under attack) from the backlog.
- Forgetting trust boundaries - threats live where data crosses privilege levels.