Simple Guide to Secure SDLC
summary
Secure SDLC lists eight concrete stages and tools: security training, architecture review, security requirements, threat modeling, static code analysis, open source analysis, dynamic testing and pen testing. Recommended tools include SD Elements and goSTL for requirements, Microsoft Threat Modeling Tool or Threat Dragon, Checkmarx/Fortify for static scans, WhiteSource/SourceClear/Snyk for dependencies, OWASP ZAP/Burp/AppScan for dynamic testing. Equifax is cited as a 146 million‑record lesson; start by automating static and open‑source scans for the biggest immediate payoff.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:47Good News!
- 2:32Security Training
- 5:30Architecture Review
- 7:25Security Requirements
- 8:54Threat Modeling
- 11:50Static Code Analysis
- 15:06Open Source Analysis
- 18:49Dynamic Testing
- 20:57Penetration Testing
- 23:118 Components
related talks
56mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
52mSo Long Secure Coding - Practical Steps for Securing the entire SDLC
20mSecure Software Development Lifecycle
57mThe Developer's Field Guide to Software Security
44mSecurity Practices Useful in Agile Development
41mImplementing SDLC in Combat Conditions
52mContinuous Security
01h 02mSo long secure coding... Hello secure development!