thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Secure Software Development Life Cycle (SSDLC)

A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.

Definition

An SSDLC adds security requirements, threat modeling, secure coding standards, security testing, secure release and incident response to each SDLC phase rather than testing for security only at the end. Common reference models include Microsoft SDL, NIST SSDF, OWASP SAMM and BSIMM. Finding and fixing flaws early is far cheaper than fixing them in production.

Example

A team adds a threat-modeling step to design reviews and a SAST gate to its build pipeline as part of its SSDLC.

Exam tip

Expect questions asking which phase an activity belongs to; threat modeling is a design-phase activity and fuzzing/DAST are testing-phase activities.

Related terms