Security Development Lifecycle
noun · secure coding practice · element 84 of 117
Building security in from the start: threat modelling, secure coding rules and testing at every stage instead of a check at the end.
- In my work since
- 2017
- Family
- Engineering
What is Security Development Lifecycle?
A Security Development Lifecycle puts security work into every stage of building software: requirements, threat modelling, design review, secure coding rules, code analysis, testing and a plan for incidents. Microsoft introduced its SDL in 2004 and the idea spread across the industry.
For web work the classics are SQL injection, cross-site scripting and cross-site request forgery, all of which come down to validating input, escaping output and checking who is allowed to do what.
How I use Security Development Lifecycle
At Bizzolutions I co-developed applications and secure website configurations to a Security Development Lifecycle, focused on SQL injection, cross-site scripting and request forgery. I also proofread ransomware research there, and I co-authored three papers on ransomware.
The habits carry straight into WordPress: sanitise input, escape output, check nonces and capabilities.
- BizzolutionsSecure developmentBizzolutions · 2017 to 2019