Which statement best describes the secure software development life cycle (s-SDLC) and its security activities?

• A. Integrate security into every SDLC phase: requirements, design, implementation, testing, deployment; activities include threat modeling, secure coding, code reviews, and security testing.
• B. Security is applied only during the design phase.
• C. Security testing occurs only after deployment.
• D. Threat modeling is optional.

Answer: (A)

Integrating security across every phase of the SDLC is what s-SDLC is about. It means defining security requirements upfront, modeling threats during design to uncover and mitigate risks, applying secure coding practices during implementation, performing code reviews to catch vulnerabilities, and conducting security testing—including static and dynamic analysis and independent testing—throughout development and before release. Even deployment involves secure configuration and ongoing monitoring to manage vulnerabilities.

This approach is superior because security isn’t a one-time or late-stage activity; it must be woven into requirements, design, and deployment as well as testing. Security testing should occur during development, not only after deployment, and threat modeling should be a standard, ongoing practice.