<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-secure-development-lifecycle
description: >-
  Implement secure development lifecycle (SDLC) practices including threat
  modeling, SAST/DAST CI/CD integration, dependency scanning, security
  gates, code review checklists, and security training programs.
domain: cybersecurity
subdomain: application-security
tags:
  - sdlc
  - devsecops
  - threat-modeling
  - sast
  - dast
  - dependency-scanning
  - owasp-a06
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195"]
  owasp-top10: ["A06"]
  tools: ["semgrep", "trivy", "nuclei", "owasp-zap", "snyk"]
---

# Implementing Secure Development Lifecycle

## Overview

A secure development lifecycle integrates security at every phase — from
design through deployment. Key practices include threat modeling during
design, SAST in code review, dependency scanning in build, DAST in staging,
and security monitoring in production.

## Prerequisites

- Tools: ["semgrep", "trivy", "nuclei", "owasp-zap", "snyk"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: Threat Modeling

```bash
# Generate data flow diagram with pytm
pip install pytm
python3 -c "
from pytm import TM, Server, Datastore, Dataflow, Boundary, Actor
tm = TM('Web Application')
internet = Boundary('Internet')
dmz = Boundary('DMZ')
user = Actor('User')
web = Server('Web Server')
db = Datastore('Database')
user.inBoundary = internet
web.inBoundary = dmz
Dataflow(user, web, 'HTTPS Request')
Dataflow(web, db, 'SQL Query')
tm.process()
"

# STRIDE per component: Spoofing, Tampering, Repudiation,
# Information Disclosure, Denial of Service, Elevation of Privilege
```

### Step 2: SAST in CI/CD Pipeline

```yaml
# GitHub Actions SAST workflow
name: Security Scan
on: [push, pull_request]
jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Semgrep SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/security-audit
      - name: CodeQL Analysis
        uses: github/codeql-action/analyze@v3
```

### Step 3: Dependency Scanning

```bash
# Trivy dependency scan
trivy fs --security-checks vuln --severity HIGH,CRITICAL .

# npm audit
npm audit --audit-level=high

# pip-audit for Python
pip-audit --strict --desc

# Snyk test
snyk test --severity-threshold=high

# OWASP Dependency-Check
dependency-check --project "MyApp" --scan . --format JSON
```

### Step 4: DAST Integration

```bash
# OWASP ZAP baseline scan in CI
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://staging.target.com -J report.json

# Nuclei CI scan
nuclei -u https://staging.target.com \
  -t http/vulnerabilities/ -severity critical,high \
  -json -o nuclei-results.json

# DAST as quality gate
if [ $(jq '.vulnerabilities | length' report.json) -gt 0 ]; then
  echo "DAST findings detected — blocking deployment"
  exit 1
fi
```

### Step 5: Security Gates and Metrics

```bash
# Define security gates per environment
# DEV: SAST (semgrep) — block on critical
# STAGING: SAST + DAST (ZAP baseline) — block on high+
# PROD: Full DAST + dependency scan — block on medium+

# Track security metrics
# - Mean time to remediate (MTTR) per severity
# - SAST finding density per 1000 LOC
# - Dependency vulnerability age
# - Security gate pass rate
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Pipeline bypass | CI/CD logs | Deploys without security gate pass |
| Dependency vuln | SCA alerts | Critical CVE in production dependencies |
| SAST regression | PR checks | New critical findings in pull request |

```yaml
title: Secure Development Lifecycle Detection
id: d9866a80-028f-4f6d-a17f-5b6ebc3d0afb
status: experimental
description: Detects suspicious activity related to implementing secure development lifecycle techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1195
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
