Software Development Security
Software Development Security tests how security is built into the software lifecycle, from requirements and design through deployment and maintenance. Questions cover threat modeling, secure coding, testing types, CI/CD controls, and supply-chain risk.
Core rules and concepts
- SDLC phases: requirements, design, development, testing, deployment, maintenance. Security activities belong in each phase; retrofitting at the end is costly.
- Threat modeling identifies assets, trust boundaries, threats, and mitigations. STRIDE covers spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
- SAST analyzes source or bytecode without running the application; DAST tests a running application from outside; SCA identifies vulnerable dependencies; IAST combines runtime instrumentation.
- Secure coding addresses input validation, output encoding, parameterized queries, authentication, session management, error handling, and secrets management.
- DevSecOps automates security gates in CI/CD, signs artifacts, scans images, and manages secrets outside code.
Worked example
A login feature is threat modeled with STRIDE. Spoofing suggests MFA and rate limiting; tampering suggests signed session tokens; information disclosure suggests generic error messages and TLS; elevation of privilege suggests server-side authorization checks. The team chooses parameterized queries for the user lookup, adds SAST to the pull-request pipeline, runs DAST in staging, and uses SCA to block a dependency with a known critical vulnerability. Secrets are stored in a vault, not in the repository. The release gate requires critical findings to be closed or formally accepted.
Traps
Confusing SAST with DAST; treating SCA as runtime protection; testing security only before release; and hard-coding secrets in source or CI logs.