AI › Module 7 › Lesson 1
Secure SDLC AI
Secure SDLC for AI literacy — threat model, data governance, model card, release gate — on `$AI_LAB` dev workflow stubs.
Visual · t32_secure_sdlc_ai
Secure SDLC AI = named lifecycle rows. $AI_LAB. Original Cyberlium.
Opening
AI features need SDLC gates like any software — name secure AI lifecycle rows on YOUR lab workflow before shipping toy apps.
Secure SDLC for AI literacy names: AI threat modeling category (STRIDE-for-LLM literacy stub), training data provenance, model card / system card category, pre-release eval gate, monitoring and incident category, and change control for prompts/models. Analyst drafts SDLC checklist on `$AI_LAB` toy app repo — maps five lifecycle gates with owner stub — without skipping eval for 'demo speed,' without training on scraped PII, without deploying lab jailbreak findings to prod without RoE. Cyberlium teaches defender lifecycle vocabulary on YOUR repos — NOT shortcut to weaponized releases. Refused: skip eval gate, prod deploy without ticket, malware-gen in CI. Lab row: secure AI SDLC checklist ten items applied to toy app.
1. Named lifecycle gates
Threat model, data provenance, model card, eval gate, monitoring — five literacy anchors.
Each gate maps to artifact in YOUR `$AI_LAB` toy repo.
Command guide
Try these commands — Named lifecycle gates
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF — https://csrc.nist.gov/projects/ssdf (secure development lifecycle) NIST AI RMF — https://www.nist.gov/itl/ai-risk-management-framework OWASP LLM Top 10 — https://owasp.org/www-project-top-10-for-large-language-model-applications/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
curl -sS https://www.nist.gov/itl/ai-risk-management-framework | head -10
cat > "$AI_LAB/notes/secure-sdlc-ai-checklist.md" <<'EOF'
# Secure SDLC for AI — YOUR project notes
- [ ] Threat model: prompt injection, RAG poison, tool abuse
- [ ] Security requirements in user stories
- [ ] Pre-release red team on YOUR staging app (authorized)
- [ ] Monitoring: prompt/response logging with PII redaction
- [ ] Patch cadence for model + dependency updates
EOFCommand — copy this
grep '\[ \]' "$AI_LAB/notes/secure-sdlc-ai-checklist.md"
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SSDF (https://csrc.nist.gov/projects/ssdf); NIST AI RMF (https://www.nist.gov/itl/ai-risk-management-framework); OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Release discipline
No prompt/model change without eval rerun category — document on lab checklist.
Change control stub links Module 6 app security rows.
3. $AI_LAB boundary
YOUR toy repo or instructor stub only — not employer prod pipeline without RoE.
Refused: skip gates, scraped PII training, weaponized release artifacts.
4. What you ship: secure AI SDLC checklist
Ten lifecycle items applied to toy app + NEVER skip eval gate line.
5. What you record before the next lesson
Secure AI SDLC checklist path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Ship toy app to prod skipping eval because 'it's just AI demo.'
Right
Secure AI SDLC checklist from `$AI_LAB` toy repo. Next: Eval and Guards.
Mission: secure AI SDLC checklist
1) Name five SDLC gates. 2) Ten-item checklist on toy app. 3) Owner stub per gate UTC. 4) Write NEVER skip eval gate line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Model card — minimum literacy fields?”
Knowledge Check
APPLY: Secure SDLC AI uses:
Multiple choice
Knowledge Check
APPLY: True or False: Eval gate optional for AI demos.
True or False
Knowledge Check
APPLY: SDLC gates include:
Multiple choice