Principles of Information Security: Secure SDLC and DevSecOps

Secure SDLC and DevSecOps

Secure SDLC & DevSecOps: Exam-Ready Study Guide

What This Is

Secure Software Development Lifecycle (SDLC) integrates security practices into every phase of software development—from planning to deployment and maintenance. DevSecOps extends DevOps by embedding security into CI/CD pipelines, ensuring continuous security testing and compliance. This is critical because most breaches exploit vulnerabilities in software (e.g., the 2017 Equifax breach, where an unpatched Apache Struts vulnerability exposed 147 million records). Without secure SDLC/DevSecOps, organizations ship code with hidden flaws, leading to data leaks, ransomware, or compliance violations (e.g., GDPR fines).

Key Terms & Concepts

• SDLC (Software Development Lifecycle): A structured process for building software (e.g., Waterfall, Agile, Spiral). Secure SDLC adds security checks at each phase (e.g., threat modeling in design, SAST/DAST in testing).

• Standards: NIST SP 800-64, ISO/IEC 27034, OWASP SAMM.

• DevSecOps: A culture and set of practices that automate security in DevOps pipelines. Shifts security "left" (earlier in the SDLC) and makes it everyone’s responsibility.

• Tools: SAST (SonarQube), DAST (OWASP ZAP), SCA (Snyk), IaC scanning (Checkov), secrets detection (GitLeaks).

• Shift-Left Security: Moving security testing earlier in the SDLC (e.g., code reviews, threat modeling) to catch flaws before production.

• Example: Running static analysis (SAST) during coding, not just before release.

• SAST (Static Application Security Testing): Analyzes source code for vulnerabilities (e.g., SQLi, hardcoded secrets) without executing the program.

• Tools: SonarQube, Fortify, Checkmarx.

• DAST (Dynamic Application Security Testing): Tests running applications for vulnerabilities (e.g., XSS, CSRF) by simulating attacks.

• Tools: OWASP ZAP, Burp Suite, Nessus.

• SCA (Software Composition Analysis): Scans third-party/open-source components for known vulnerabilities (e.g., Log4j, Heartbleed).

• Tools: Snyk, Black Duck, Dependency-Track.

• IaC (Infrastructure as Code): Managing infrastructure via code (e.g., Terraform, CloudFormation). Secure IaC scans for misconfigurations (e.g., open S3 buckets).

• Tools: Checkov, Terrascan, AWS Config.

• Threat Modeling: A structured approach to identify, prioritize, and mitigate threats (e.g., STRIDE, DREAD, PASTA).

• Frameworks: Microsoft STRIDE, OWASP Threat Dragon, MITRE ATT&CK.

• CI/CD (Continuous Integration/Continuous Deployment): Automates building, testing, and deploying code. DevSecOps adds security gates (e.g., fail builds on critical vulnerabilities).

• Tools: Jenkins, GitLab CI/CD, GitHub Actions.

• Secrets Management: Securely storing and rotating credentials (e.g., API keys, DB passwords) to prevent leaks.

• Tools: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault.

• Rugged DevOps: A mindset emphasizing resilience, security, and reliability in DevOps (coined by Gene Kim and Josh Corman).

• OWASP Top 10: A list of the most critical web application security risks (e.g., Injection, Broken Authentication).

• 2021 Top Risks: A01:2021-Broken Access Control, A03:2021-Injection.

Step-by-Step / Process Flow

1. Plan: Define Security Requirements

• Actions:
• Conduct a risk assessment (NIST SP 800-30) to identify threats (e.g., data breaches, insider threats).
• Define security requirements (e.g., "All passwords must use Argon2 hashing").
• Perform threat modeling (STRIDE) to map attack surfaces.
• Tools: OWASP Threat Dragon, Microsoft Threat Modeling Tool.

2. Design: Secure Architecture

• Actions:
• Apply secure design principles (e.g., least privilege, defense in depth, fail-secure).
• Use secure coding standards (e.g., OWASP ASVS, CERT Secure Coding).
• Implement IaC security (e.g., scan Terraform templates for misconfigurations).
• Example: Avoid hardcoding secrets; use a secrets manager instead.

3. Develop: Secure Coding & SAST

• Actions:
• Train developers on OWASP Top 10 and secure coding (e.g., input validation, output encoding).
• Run SAST tools (e.g., SonarQube) in the IDE or CI pipeline to catch flaws early.
• Use SCA tools (e.g., Snyk) to scan dependencies for vulnerabilities.
• Example: Block builds if critical vulnerabilities (e.g., Log4j) are detected.

4. Test: DAST & Penetration Testing

• Actions:
• Run DAST tools (e.g., OWASP ZAP) against staging environments.
• Conduct manual penetration testing (e.g., Burp Suite, Metasploit) for high-risk apps.
• Perform red team exercises to simulate real-world attacks.
• Example: DAST finds an XSS vulnerability in a web app before production.

5. Deploy: Secure CI/CD & IaC

• Actions:
• Enforce security gates in CI/CD (e.g., fail builds on critical SAST/DAST findings).
• Scan IaC templates (e.g., Terraform, Kubernetes) for misconfigurations.
• Use immutable infrastructure (e.g., containers, serverless) to reduce attack surface.
• Example: Jenkins pipeline fails if Checkov detects an open S3 bucket in Terraform.

6. Operate & Monitor: Runtime Security

• Actions:
• Deploy RASP (Runtime Application Self-Protection) to block attacks in real time.
• Monitor with SIEM (e.g., Splunk, ELK) for anomalies (e.g., brute-force attacks).
• Conduct continuous vulnerability scanning (e.g., Nessus, OpenVAS).
• Example: RASP blocks a SQL injection attempt in production.

Common Mistakes

Certification Exam Tips

CISSP

• Focus: Management-level concepts (e.g., governance, risk management in SDLC).
• Tricky Question: "Which phase of the SDLC is most cost-effective for fixing vulnerabilities?"
• Answer: Design (shifting left saves money).
• Trap: CISSP may ask about NIST SP 800-64 (Secure SDLC) or ISO 27034 (Application Security).

Security+

• Focus: Tools and processes (e.g., SAST vs. DAST, OWASP Top 10).
• Tricky Question: "Which tool is best for detecting hardcoded API keys in source code?"
• Answer: SAST (e.g., SonarQube, GitLeaks).
• Trap: Security+ may test STRIDE (threat modeling) or CI/CD security gates.

CEH

• Focus: Attacker perspective (e.g., how to exploit weak SDLC processes).
• Tricky Question: "An attacker exploits a misconfigured S3 bucket. Which SDLC phase failed?"
• Answer: Deploy (IaC scanning) or Design (secure architecture).
• Trap: CEH may ask about OWASP ZAP (DAST) or Metasploit (pen testing).

Quick Check Questions

1. A development team uses Jenkins for CI/CD but skips security scans to speed up deployments. Which risk is MOST likely to occur?

• A) Increased phishing attacks
• B) Unpatched vulnerabilities in production
• C) Misconfigured firewall rules
• D) Weak password policies
• Answer: B) Unpatched vulnerabilities in production.
• Explanation: Skipping security scans (e.g., SAST/DAST) allows flaws like SQLi or XSS to reach production.

2. During which SDLC phase should threat modeling (e.g., STRIDE) be performed?

• A) Planning
• B) Design
• C) Testing
• D) Deployment
• Answer: B) Design.
• Explanation: Threat modeling identifies risks early, when architecture can still be adjusted.

3. A company deploys a web app with hardcoded database credentials. Which DevSecOps practice would have prevented this?

• A) SAST
• B) DAST
• C) Secrets management
• D) Immutable infrastructure
• Answer: C) Secrets management.
• Explanation: Secrets managers (e.g., Vault) store and rotate credentials securely.

Last-Minute Cram Sheet

1. Secure SDLC = Security in every phase (Plan → Design → Develop → Test → Deploy → Operate).
2. DevSecOps = DevOps + Security automation (CI/CD + SAST/DAST/SCA).
3. Shift-left = Test early (SAST in coding, DAST in staging).
4. SAST = Static analysis (code at rest; e.g., SonarQube).
5. DAST = Dynamic analysis (running app; e.g., OWASP ZAP).
6. SCA = Dependency scanning (e.g., Snyk for Log4j).
7. IaC = Infrastructure as Code (scan with Checkov/Terrascan).
8. Threat modeling = STRIDE (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege).
9. OWASP Top 10 = Web app risks (A01:2021 = Broken Access Control).
10. ⚠️ CISSP trap: "Secure SDLC is only for developers" → False (security is everyone’s job).