Secure › Module 2 › Lesson 1
SDLC Named
Name the secure SDLC phases — plan security in YOUR $MY_REPO from requirements to deploy.
Visual · sdlc_named
SDLC phases literacy. $MY_REPO only. Original Cyberlium.
Opening
A secure SDLC is a named pipeline — not a reason to DAST a stranger's production shop.
Software Development Life Cycle (SDLC) phases — requirements, design, implementation, test, deploy, maintain — each get security checkpoints. Secure SDLC adds threat awareness, code review, dependency tracking, and security testing on code you ship. Cyberlium teaches phase vocabulary on $MY_REPO — your toy app lifecycle. You will NOT skip straight to sqlmap on a live storefront, threat-model a classmate's startup without invitation, or 'shift left' by attacking employer production without ticket. Next: Threat in Design.
1. Phases defenders and developers share
Requirements: security user stories and abuse cases. Design: trust boundaries and data flows. Implementation: secure patterns (validate, encode, parameterize). Test: unit tests plus security tests on owned lab deploy. Deploy: config hardening. Maintain: patch dependencies and rotate secrets.
On $MY_REPO, map your toy app to these phases in notes before any tool runs — document like a team planning a safe release.
Command guide
Try these commands — Phases defenders and developers share
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP SAMM — https://owaspsamm.org/ (software assurance maturity) NIST SSDF — https://csrc.nist.gov/publications/detail/sp/800-218/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "phases=['requirements','design','implement','verify','release','respond']; [print(f'- {p}: security criteria') for p in phases]"
curl -sS https://owaspsamm.org/ | head -5Primary tools to practice this lesson: python3, curl. Reference sites: OWASP SAMM (https://owaspsamm.org/); NIST SSDF (https://csrc.nist.gov/publications/detail/sp/800-218/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Secure SDLC is a map, not a weapon
OWASP SAMM, BSIMM, and vendor secure-SDLC guides describe maturity levels. Applying them requires tickets, backups, and rollback on repos you own.
Copy-pasting 'security sprint' checklists from blogs onto stranger production is misuse — not secure-coding homework.
3. Lab boundary on $MY_REPO
Verify repo path matches $MY_REPO before opening threat notes or CI config. Branch for lab work; merge when checks pass locally.
Ship: SDLC phase table for $MY_REPO toy app. Next: Threat in Design.
4. What you ship: SDLC phase map for $MY_REPO
Document six phases and one security checkpoint each for YOUR toy app. No stranger deploy testing. chmod 600.
5. What you record before the next lesson
Date. $MY_REPO SDLC phase table. NEVER stranger SaaS/live shops. File t17-m02-l01-sdlc-named.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip design and sqlmap a live shop 'because test phase.' Threat-model a classmate's app without their OK.
Right
Inventory SDLC phases on $MY_REPO. Next: Threat in Design.
Mission: SDLC phase map on YOUR repo
1) List six SDLC phases for $MY_REPO. 2) Add one security checkpoint per phase. 3) Branch for lab work if using git. Never threat-model stranger production.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how to sketch a phase table — not how to DAST a live shop.
Knowledge Check
APPLY: Secure SDLC primarily describes:
Multiple choice
Knowledge Check
APPLY: True or False: You may skip design and attack production to 'test faster.'
True or False
Knowledge Check
APPLY: Before adding security CI on $MY_REPO you should:
Multiple choice