What is the SDLC and security?
D4 · Operations · CompTIA Security+ SY0-701The SDLC (Software Development Lifecycle) is the structured process for planning, creating, testing, and deploying software. A Secure SDLC integrates security activities into each phase rather than treating security as an afterthought.
SDLC phases with security activities:
📋 Requirements — security requirements, privacy by design
🎨 Design — threat modeling, security architecture review
💻 Development — secure coding standards, SAST, peer code review
🧪 Testing — DAST, pen testing, vulnerability scanning
🚀 Deployment — hardening, secrets management
🔧 Maintenance — patch management, monitoring
SDLC phases with security activities:
📋 Requirements — security requirements, privacy by design
🎨 Design — threat modeling, security architecture review
💻 Development — secure coding standards, SAST, peer code review
🧪 Testing — DAST, pen testing, vulnerability scanning
🚀 Deployment — hardening, secrets management
🔧 Maintenance — patch management, monitoring
Fixing security issues early in the SDLC is 30× cheaper than fixing them in production. Threat modeling (identifying threats during design) is the most cost-effective security activity. DevSecOps = Dev + Sec + Ops — security integrated into CI/CD pipelines. OWASP SAMM is a maturity model for secure SDLC.