How do you implement secure software development lifecycle practices?
Secure SDLC integrates security into every phase of software development. Phases: (1) Requirements: identify security requirements, perform threat modeling (STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), define security acceptance criteria, and classify data sensitivity. (2) Design: apply security design principles (least privilege, defense in depth, fail securely, separation of duties), review architecture for security implications, and select secure frameworks and libraries. (3) Implementation: follow secure coding guidelines (OWASP Top 10 mitigations), use parameterized queries exclusively (prevent SQL injection), implement output encoding (prevent XSS), validate all inputs at trust boundaries, manage secrets securely (never in code), and implement proper error handling (no stack traces in production). (4) Testing: run SAST (Static Application Security Testing) tools in CI (SonarQube, Semgrep, CodeQL), run DAST (Dynamic Application Security Testing) against running application (OWASP ZAP), perform dependency scanning (Snyk, Dependabot), and conduct manual penetration testing before major releases. (5) Deployment: scan container images for vulnerabilities, implement infrastructure security (least privilege IAM, encryption, network segmentation), configure security headers (CSP, HSTS, X-Content-Type-Options), and validate deployment configuration against security baselines. (6) Operations: implement security monitoring (SIEM, WAF, IDS), conduct regular vulnerability scanning, maintain incident response procedures, and perform periodic security reviews. Automation: implement security checks as CI/CD pipeline stages (block deployment if critical vulnerabilities found), automate dependency updates, implement automated secret scanning (prevent secret commits), and use policy-as-code for infrastructure security (OPA, Sentinel). Metrics: vulnerability density per release, time to remediate by severity, security test coverage, and incident response time.