secure-development-lifecycle

# 🛡️ Secure Development Lifecycle (SDLC) Skill ## 🔴 AI FIRST Quality Principle > **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.** ## 🎯 Purpose Comprehensive security practices for the entire Software Development Lifecycle (SDLC), ensuring security is built in from inception through maintenance. Integrates classification-driven requirements, AI-augmented development controls, and systematic testing frameworks aligned with Hack23 Secure Development Policy. ### 🔗 Governance chain Authority flows from the [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) (master ISMS document) → [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) (SDLC requirements) → this skill (operational implementation in this repository). Directly relevant companion policies: - [Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) — every dependency introduced during SDLC must be licence-cleared and tracked in SBOM - [AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) — Copilot and agent-generated code require human review and DCO sign-off - [Threat Modeling](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md) · [Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) · [Change Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Change_Management.md) · [Access Control](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Access_Control_Policy.md) · [Cryptography](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md) · [Incident Response](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md) · [Security Metrics](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Security_Metrics.md) · [CLASSIFICATION](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) ## 🔐 Core Security Principles ### 🔐 Security by Design - **🏷️ Project Classification**: CIA triad, RTO/RPO, business impact analysis - **🛡️ Secure Coding Standards**: OWASP Top 10 alignment with classification controls - **🏗️ Architecture Documentation**: SECURITY_ARCHITECTURE.md + FUTURE_SECURITY_ARCHITECTURE.md ### 🌟 Transparency Through Documentation - **📋 Living Security Architecture**: Real-time documentation with classification controls - **🎖️ Public Security Badges**: OpenSSF Scorecard, SLSA, Quality Gate validation - **🔓 Open Development**: Demonstrating expertise while maintaining classification ### 🔄 Continuous Security Improvement - **🏷️ Classification-Driven Testing**: SAST/SCA/DAST per classification levels - **📈 Performance Monitoring**: Security metrics with availability SLAs - **🔍 Regular Reviews**: Classification-based risk management and ROI ## 🔄 5-Phase SDLC Security Framework ### 📋 Phase 1: Planning & Design #### 🏷️ Project Classification (REQUIRED) Apply [Classification Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md): - [ ] CIA Triad Analysis (Confidentiality, Integrity, Availability) - [ ] Business Impact Classification (Revenue, Trust, Compliance) - [ ] RTO/RPO Definition (Recovery Time/Point Objectives) - [ ] Risk Assessment Integration with [Risk Register](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Risk_Register.md) - [ ] Cost-Benefit Analysis (Security ROI) **Classification Levels:** | Level | Confidentiality | Integrity | Availability | Security Investment | |-------|----------------|-----------|--------------|-------------------| | **Critical** | State secrets | Financial | <1 hour RTO | Maximum controls | | **High** | Proprietary | Legal | 4 hour RTO | Strong controls | | **Medium** | Internal | Operational | 24 hour RTO | Standard controls | | **Low** | Public | Informational | 72 hour RTO | Baseline controls | #### 🏗️ Security Architecture Design (REQUIRED) Maintain comprehensive architecture documentation: - [ ] **SECURITY_ARCHITECTURE.md**: Current implemented security design - [ ] **FUTURE_SECURITY_ARCHITECTURE.md**: Planned security improvements - [ ] **ARCHITECTURE.md**: Complete C4 models (Context, Container, Component, Code) - [ ] **DATA_MODEL.md**: Data structures and classifications - [ ] **FLOWCHART.md**: Business process flows with security controls #### 🎯 Threat Modeling (MANDATORY) Per [Threat Modeling Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md): - [ ] **STRIDE Framework**: Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege - [ ] **MITRE ATT&CK Integration**: 14 tactics mapped with techniques - [ ] **Attack Tree Analysis**: Graphical attack path decomposition - [ ] **Threat Agent Classification**: 7 categories (Accidental Insiders → Nation-State APTs) - [ ] **THREAT_MODEL.md**: Comprehensive 9-section threat documentation ### 💻 Phase 2: Development #### 🛡️ Secure Coding Guidelines **OWASP Top 10 (2021) Alignment:** 1. **A01 - Broken Access Control**: Proper authentication/authorization 2. **A02 - Cryptographic Failures**: TLS 1.3, AES-256 encryption 3. **A03 - Injection**: Parameterized queries, input validation 4. **A04 - Insecure Design**: Apply threat modeling, secure patterns 5. **A05 - Security Misconfiguration**: Secure defaults, hardened configs 6. **A06 - Vulnerable Components**: SCA scanning, SBOM generation 7. **A07 - Authentication Failures**: MFA, secure session management 8. **A08 - Software/Data Integrity**: Code signing, integrity checks 9. **A09 - Logging Failures**: Comprehensive security event logging 10. **A10 - SSRF**: Validate external resource requests #### 🔍 Code Review Requirements **Classification-Based Review:** | Classification | Review Type | Required Approvals | Security Focus | |----------------|-------------|-------------------|----------------| | **Critical** | Formal security review | 2+ reviewers + security architect | All OWASP Top 10 | | **High** | Security-focused PR review | 2+ reviewers | Critical vulnerabilities | | **Medium** | Standard PR review | 1+ reviewer | Input validation, auth | | **Low** | Standard PR review | 1 reviewer | Basic security checks | #### 🔐 Secret Management (MANDATORY) - [ ] **Zero Hard-Coded Credentials**: No secrets in source code - [ ] **GitHub Secrets**: All credentials in encrypted secrets - [ ] **Rotation Policy**: Critical: 90 days, High: 180 days, Medium/Low: 365 days - [ ] **Access Logging**: All secret access logged and monitored - [ ] **Least Privilege**: Secrets scoped to minimum required access ### 🧪 Phase 3: Security Testing #### 🔬 Static Application Security Testing (SAST) **Implementation:** - **Tool**: SonarCloud integration on every commit - **Quality Gates**: Classification-based failure thresholds - **Coverage**: All code analyzed for security vulnerabilities - **Reporting**: Public quality/security dashboards **Classification-Based Quality Gates:** | Classification | Security Hotspots | Code Coverage | Duplications | Maintainability | |----------------|------------------|---------------|--------------|-----------------| | **Critical** | 0 (block) | ≥90% | <3% | A rating | | **High** | ≤2 (review) | ≥80% | <5% | A or B rating | | **Medium** | ≤5 (track) | ≥70% | <10% | B or C rating | | **Low** | ≤10 (monitor) | ≥60% | <15% | C rating | #### 📦 Software Composition Analysis (SCA) **Dependency Security:** - [ ] **Automated Scanning**: Dependabot, Snyk, or equivalent - [ ] **SBOM Generation**: Software Bill of Materials for all releases - [ ] **Vulnerability Database**: CVE, NVD, GitHub Advisory integration - [ ] **Update Policy**: Classification-based patching SLAs - [ ] **License Compliance**: OSS license validation **Remediation SLAs:** | Severity | Critical Project | High Project | Medium Project | Low Project | |----------|-----------------|-------------|----------------|-------------| | **Critical** | 24 hours | 72 hours | 1 week | 2 weeks | | **High** | 1 week | 2 weeks | 1 month | 2 months | | **Medium** | 1 month | 2 months | 3 months | 6 months | | **Low** | Next release | Next release | Next release | Next release | #### ⚡ Dynamic Application Security Testing (DAST) **Runtime Security Testing:** - **Tool**: OWASP ZAP, Burp Suite, or equivalent - **Scope**: Staging environments (classification-appropriate) - **Frequency**: Per sprint (Critical/High), quarterly (Medium/Low) - **Coverage**: All authentication, authorization, input handling paths #### 🔍 Secret Scanning (CONTINUOUS) - [ ] **GitHub Secret Scanning**: Enabled on all repositories - [ ] **Pre-commit Hooks**: Detect secrets before commit - [ ] **Historical Scanning**: Scan entire git history - [ ] **Alert Integration**: Immediate notifications to security team - [ ] **Remediation SLA**: Critical secrets rotated within 1 hour #### 📋 Test Data Protection (MANDATORY) - [ ] **Zero Production Data**: Never use real data in dev/test - [ ] **Data Anonymization**: Pseudonymize test data - [ ] **Secure Deletion**: Wipe test data after use - [ ] **Access Control**: Least privilege for test environments ### 🎯 Unit Test Coverage & Quality #### 📊 Testing Standards **Minimum Thresholds:** - **Line Coverage**: ≥80% (Critical/High), ≥70% (Medium/Low) - **Branch Coverage**: ≥70% (Critical/High), ≥60% (Medium/Low) - **Mutation Testing**: ≥60% mutation score (Critical only) - **Test Execution**: Every commit and PR - **Trend Analysis**: Historical tracking, regression prevention #### 📚 Required Documentation **Every repository MUST have:** - [ ] **UnitTestPlan.md**: Comprehensive unit test strategy - [ ] **Test Results**: Public HTML reports (GitHub Pages) - [ ] **Coverage Dashboards**: Accessible coverage metrics - [ ] **Quality Badges**: Status badges in README.md #### 📊 Reference Implementation Examples **🏛️ Citizen Intelligence Agency (Java/Spring):** [](https://hack23.github.io/cia/jacoco/) [](https://hack23.github.io/cia/surefire.html) [](https://github.com/Hack23/cia/blob/master/UnitTestPlan.md) **🎮 Black Trigram (TypeScript/Phaser):** [](https://blacktrigram.com/coverage/) [](https://blacktrigram.com/test-results/) [](https://github.com/Hack23/blacktrigram/blob/main/UnitTestPlan.md) **📊 CIA Compliance Manager (TypeScript/Vite):**