Recently, I have read a great deal about SDLC, so I am recording the most important points here and explaining them concisely.

0x01 Introduction to SDL

SDL is a security best practice proposed by Microsoft for managing the software development security lifecycle. Its full name is Security Development Lifecycle.

0x02 Why SDL Is Necessary

Its purpose is to address application security issues at the root where vulnerabilities originate and to ensure product security by controlling the software development process.

SDL primarily focuses on security assurance throughout the software development process—what many people now refer to as “shifting security left.”

SDL is mainly dedicated to integrating security into the software development process and minimizing the number of vulnerabilities in software as early as possible.

Core Issues

The core philosophy of SDL is to integrate security considerations into every stage of software development: requirements analysis, design, coding, testing, and maintenance.

Corresponding security activities are added to every stage, from requirements and design through product release, to reduce the number of vulnerabilities in the software and minimize security defects.

SDL is based on three core principles: training and education, continuous process improvement, and accountability.

One of SDL’s main goals is security and privacy.

SDL provides security and privacy protection throughout all stages of the development process.

SDL的核心理念是将安全考虑集成在软件开发的每一个阶段:需求分析、设计、编码、测试和维护。从需求、设计到发布产品的每一个阶段每都增加了相应的安全活动，以减少软件中漏洞的数量并将安全缺陷降低到最小程度

0x03 Control of the Main Process

Security personnel’s control over the process is crucial to driving implementation in their work.

0 Security Training

Security awareness training for product, design, development, and security personnel.

Security training is one of the core elements of SDL. Preparations should be made before any project is initiated.

Secure coding
Security awareness
Security knowledge base (explaining vulnerability principles and remediation solutions)
Security SDKs (have architects implement certain vulnerability remediation methods through SDKs, so developers only need to import the package—for example, secure HTTP methods that prevent SSRF and can be called transparently by developers)

1 Project Initiation Stage (Security Requirements Design)

All projects must be initiated through the system. During the project initiation review meeting, security concepts should be explained, guidance should be provided regarding potential security issues in the project requirements, and security requirements should be established.

Establish development standards (Java, PHP, etc.).

2 Design Stage: PM–PRD

During the development and design review meeting, explain the security requirements CHECKLIST based on the product design.

Establish security design standards and determine security requirements with the project manager based on the requirements document, including framework design and business logic.

3 Development/Implementation Stage

Developers primarily work in IDEs such as IDEA. FindBugs and the FindSecBugs security plugin can be integrated to enable developers to perform their own code security audits.

We can use SonarQube to audit code and check whether developers’ code complies with Java development standards and OWASP standards, then communicate with the project development team through meetings.

Provide secure coding training and identify vulnerability risks in advance to reduce the workload of subsequent penetration testing.

4 Testing Stage

Static Code Scanning: SAST

Use static code scanning tools to scan code before compilation and identify various issues at the static code level.

这里主要利用就是SAST（自研、Fortify、CHeckmarx、Flawfinder）

静态代码扫描常见采用sonarQube集成，利用FindbugSecurity,精简规则，然后在持续构建过程中，进行静态代码bug,安全扫描。

DAST

In simple terms, this is a black-box scanner.

Web application scanning: Testers can perform the scans, while security personnel analyze the reports and track vulnerability remediation.

Manual penetration testing: Before a project goes live, manual testing is required in addition to automated scanning to uncover deeper vulnerabilities. Penetration testing should be performed quarterly; if there are many projects, all projects should be penetration-tested at least once every six months.

IAST

This combines black-box, white-box, and gray-box approaches. Its principle is instrumentation for taint tracking.

There is an especially useful diagram (https://www.aqniu.com/wp-content/uploads/2019/04/\%E5\%9B\%BE-9.png\).

Vulnerability remediation training: Despite all the work performed earlier, security vulnerabilities are unavoidable. When vulnerabilities appear, communicate with developers promptly and discuss them face to face.

5 Operations Monitoring

Send syslog data to a centralized logging platform for visualization, then configure the corresponding rules to generate alerts. This is what we call SIEM.

Drive system vulnerability remediation and system security baseline checks. Systems reside within the overall protection framework, so driving these efforts may not be easy. Sometimes vulnerability remediation is not about quantity but precision. System vulnerabilities that must not exist on the internal network must be remediated promptly. Promote remediation gradually and discuss the process with the operations team.

Security vulnerability management: vulnerability management system
Git monitoring: Monitor code properly to prevent source code leaks, including GitHub monitoring.
SRC operations: If funding is insufficient, use the SRC services of security platforms such as HackerOne.
Emergency response and an intrusion detection CHECKLIST: Intrusions can happen if you are not careful, so establish an intrusion detection CHECKLIST.
Build a situational awareness platform.