SECURE
SDLC
Requirements
Design
Development
Testing
Deployment
Maintenance
Development Methodologies
Waterfall
Sequential, phase-by-phase approach. Each phase must complete before the next begins. Best for well-defined requirements.
Agile/Scrum
Iterative development in sprints (2-4 weeks). Continuous feedback, flexible requirements, frequent releases.
DevSecOps
Security integrated throughout CI/CD pipeline. Automated security testing, shift-left mentality, continuous monitoring.
Spiral
Risk-driven, iterative approach. Each iteration includes risk analysis. Good for large, complex projects.
Security Testing Methods
SAST
Static Analysis - Review source code without execution
DAST
Dynamic Analysis - Test running application
IAST
Interactive - Combines SAST + DAST during testing
SCA
Software Composition - Check dependencies/libraries
Pen Testing
Simulated attacks to find vulnerabilities
Fuzzing
Random/malformed input to find crashes
CMM/CMMI Maturity Levels
1
Initial
Ad hoc, chaotic. Success depends on individual heroics.
2
Managed
Project-level processes. Reactive quality control.
3
Defined
Organization-wide standards. Proactive approach.
4
Quantitatively Managed
Metrics-driven. Statistical process control.
5
Optimizing
Continuous improvement. Innovation focus.
OWASP Top 10 (2021)
A01
Broken Access Control
Authorization failures
A02
Cryptographic Failures
Data exposure, weak crypto
A03
Injection
SQL, NoSQL, OS, LDAP
A04
Insecure Design
Missing security controls
A05
Security Misconfiguration
Default configs, verbose errors
A06
Vulnerable Components
Outdated libraries/frameworks
A07
Auth Failures
Broken authentication
A08
Integrity Failures
Insecure CI/CD, deserialization
A09
Logging & Monitoring
Insufficient logging
A10
SSRF
Server-Side Request Forgery