Secure Software Development Lifecycle (SSDLC).

An SSDLC formalizes when and how security work happens during software delivery rather than treating it as a one-off audit. Typical phases include security requirements, threat modeling, secure architecture review, secure-coding standards, code review, SAST, SCA, DAST/IAST, penetration testing, release gates and runtime monitoring. The economic case is well established: a defect caught in design costs a fraction of one found after release, so shifting security left reduces both risk and remediation cost, while compliance evidence is produced as a by-product of normal engineering.

The reference frameworks are Microsoft SDL (the original industrial model after the 2002 Trustworthy Computing memo), OWASP SAMM and BSIMM for maturity measurement, and NIST SP 800-218, the Secure Software Development Framework (SSDF v1.1, 2022). The SSDF matters beyond best practice: it was published in response to Executive Order 14028 (May 2021), itself a reaction to the 2020 SolarWinds build-system compromise, in which attackers injected the SUNBURST backdoor into a signed Orion update. Under OMB M-22-18, vendors selling to US federal agencies must now attest that they follow SSDF practices — making a documented SSDLC a procurement requirement, not just a quality goal. Securing the build and release pipeline (provenance, signing, SBOMs) is now as important as securing the code itself.

flowchart LR
  A[Requirements: security reqs] --> B[Design: threat modeling]
  B --> C[Code: secure coding + SAST/SCA]
  C --> D[Test: DAST/IAST + pentest]
  D --> E[Release: gates + signing + SBOM]
  E --> F[Operate: monitoring + patching]
  F -->|Feedback / new risks| A