A secure development lifecycle
🏠The everyday picture
Fire safety in a building is planned in the drawings (exits, materials), checked during construction, and inspected before opening. Adding it after the building is finished is expensive and never as good.
📘What it really is
- A secure development lifecycle (SDLC) adds security activities to each stage of normal work:
- requirements: what data is handled, who may do what, what laws apply (Module 79); write security requirements alongside features ("only managers can export", "exports are logged");
- design: threat modelling (Module 80) for new features; choose safe patterns (proven auth libraries, parameterised queries);
- build: secure coding habits, small reviewed changes, secrets kept out of code;
- test: security tests alongside normal ones (authorisation refusals, XSS inputs), plus automated scanners;
- release: gates in CI/CD (Module 71), a security checklist for risky changes;
-
operate: monitoring, patching, incident response (Modules 72 and 80).
-
Shift left: the earlier a problem is found, the cheaper it is to fix. A design flaw found in a sketch costs minutes; found in production, it can cost a breach.
-
Useful frameworks to borrow from: OWASP SAMM (maturity model), OWASP ASVS (requirements checklist, Module 75), and NIST's Secure Software Development Framework. Small teams can take a handful of practices from them rather than everything.
-
Security champions: in a team, one person who cares about security helps others; for a solo builder, that's you, with a checklist.
🖱️Try it
Write a one-page SECURITY.md for your CRM describing your lifecycle: the security questions you ask for each new feature,
the checks in CI, how dependencies are updated, and how to report a vulnerability to you. Add three security requirements for
an upcoming feature.
✅Quick check
What does "shift left" mean?
Show the answer
Finding and fixing security problems earlier in the process, where it's cheaper.
Give one security activity for the design stage.
Show the answer
Threat modelling (or choosing safe patterns such as proven auth libraries).