Secure SDLC & Threat Modeling¶

Building secure software starts long before code — at design. The Secure Software Development Lifecycle (SSDLC) embeds security in every phase.

The SSDLC Phases¶

Phase	Security activity
Requirements	Security & privacy requirements; abuse cases
Design	Threat modeling, secure architecture review
Implementation	Secure coding standards, SAST, secret scanning
Verification	DAST, pentest, code review, fuzzing
Release	Final review, signing, hardening
Maintenance	Patching, monitoring, incident response

Threat Modeling¶

A structured exercise to find design flaws before they're built. Four guiding questions (Shostack):

1.What are we building? (diagram the system & data flows)
2.What can go wrong? (enumerate threats)
3.What are we going to do about it? (mitigations)
4.Did we do a good job? (validate)

STRIDE — A Threat Taxonomy¶

Letter	Threat	Violates
S	Spoofing	Authentication
T	Tampering	Integrity
R	Repudiation	Non-repudiation
I	Information disclosure	Confidentiality
D	Denial of service	Availability
E	Elevation of privilege	Authorization

Walk each component and data flow against STRIDE to surface threats systematically.

Trust Boundaries¶

A trust boundary is where data crosses between zones of differing trust (internet → app, app → database, user → admin). These crossings are exactly where validation and authorization must happen. Mark them on your data-flow diagram — they're where most vulnerabilities live.

Secure Coding Principles¶

Validate all input, encode all output (Chapter 5).
Fail securely — default to deny.
Least privilege for every component and credential.
Don't trust the client; enforce on the server.
Defense in depth — never rely on a single control.
Keep it simple — complexity hides bugs.
Use safe, vetted libraries — don't reinvent crypto/auth.

Risk-Based Prioritization¶

You can't fix everything at once. Rank findings by likelihood × impact, fix the highest-risk first, and track the rest. Document accepted risks and revisit them.

The Payoff¶

Security built in from design is cheaper, stronger, and faster to ship than security bolted on after a breach. Threat modeling is the highest-leverage security activity most teams skip — don't.