| name | Secure SDLC |
| description | Use when embedding security into the SDLC, mapping to NIST SSDF, or defining security gates. Triggers on 'secure SDLC', 'SSDF', 'security gates', 'shift left', 'paved road', 'security checkpoints'. |
Secure SDLC
When to invoke
- Standing up an AppSec program from scratch.
- Mapping current controls to NIST SSDF / ISO 27034 / PCI requirements.
- Defining which security checks must pass before release.
Principles
- Shift left, but also shift smart - run fast checks early, expensive checks where value is highest.
- Paved road beats policing - give developers templates and defaults that are secure by construction; audit, don't gatekeep.
- Every control has an owner - if nobody owns the alert, nothing gets fixed.
- Automate evidence - audits should be a query, not a scramble.
Gates by phase
| Phase | Control | Gate |
|---|
| Plan / design | Threat model on material changes | Design review sign-off |
| Code | Pre-commit hooks (secret scan, linter) | Blocks commit |
| PR | SAST, SCA, IaC scan | Required status check |
| Build | SBOM, container scan, signing | Fails build on Critical |
| Pre-prod | DAST on deployed env, config review | Release gate |
| Release | Signed artifact + provenance verified on deploy | Deploy-time policy |
| Run | Runtime monitoring, WAF, anomaly detection | 24/7 on-call |
| Respond | IR runbook, disclosure process | Tested quarterly |
NIST SSDF mapping (condensed)
- PO - Prepare the Organization: security policy, roles, training, toolchain.
- PS - Protect Software: integrity of source and releases (signing, branch protection).
- PW - Produce Well-Secured Software: secure design, secure coding standards, review, test.
- RV - Respond to Vulnerabilities: disclosure process, triage SLA, patching.
Every control in your SDLC should trace to one of these.
Paved road examples
- Service template with auth, logging, secrets management, and baseline SAST config preconfigured.
- Pipeline template with OIDC, signing, SBOM, and scans wired in.
- Terraform module library pre-hardened (encryption, private networking, least-privilege IAM).
- Approved libraries list with maintained versions.
Developers choosing the paved road get gates mostly for free. Off-road requires additional review.
Anti-patterns
- Security bolted on at the end (pentest two weeks before launch).
- 100 "required" checks that everyone bypasses with exceptions.
- Findings without owners, SLAs, or expiries.
- One-size-fits-all controls - a prototype doesn't need PCI evidence.
References
