Secure SDLC practices in Cybersecurity - Mini Project: Build & Apply

Understanding Secure SDLC Practices

📖 Scenario: You are part of a software development team that wants to build secure applications. To do this, you need to understand the Secure Software Development Life Cycle (SDLC) practices. These practices help keep software safe from hackers and bugs.

🎯 Goal: Build a simple checklist of Secure SDLC practices by creating a list of key steps, adding a priority level, selecting the most important steps, and finally summarizing the essential practices.

📋 What You'll Learn

Create a list of Secure SDLC steps with exact names

Add a priority level variable for security focus

Filter the list to include only high priority steps

Summarize the final list with a clear heading

💡 Why This Matters

🌍 Real World

Software developers and security teams use Secure SDLC practices to build safer software and reduce risks.

💼 Career

Understanding Secure SDLC is essential for roles like software developer, security analyst, and project manager to ensure security is integrated from the start.

1

Create the list of Secure SDLC steps

Create a list called sdlc_steps with these exact entries: 'Requirements Analysis', 'Design', 'Implementation', 'Testing', 'Deployment', 'Maintenance'.

Cybersecurity

# Create the list sdlc_steps with the exact steps
# Your code here

Hint

Use square brackets to create a list and include all steps as strings.

2

Add a priority level for security focus

Create a variable called security_priority and set it to the string 'High'.

Cybersecurity

sdlc_steps = ['Requirements Analysis', 'Design', 'Implementation', 'Testing', 'Deployment', 'Maintenance']
# Create the variable security_priority and set it to 'High'
# Your code here

Hint

Assign the string 'High' to the variable security_priority.

3

Select the most important Secure SDLC steps

Create a new list called high_priority_steps that includes only 'Requirements Analysis', 'Design', and 'Testing' from sdlc_steps.

Cybersecurity

sdlc_steps = ['Requirements Analysis', 'Design', 'Implementation', 'Testing', 'Deployment', 'Maintenance']
security_priority = 'High'
# Create high_priority_steps list with 'Requirements Analysis', 'Design', and 'Testing'
# Your code here

Hint

Make a new list with only the three specified steps.

4

Summarize the essential Secure SDLC practices

Create a string variable called summary that says: 'Key Secure SDLC practices include Requirements Analysis, Design, and Testing.'

Cybersecurity

sdlc_steps = ['Requirements Analysis', 'Design', 'Implementation', 'Testing', 'Deployment', 'Maintenance']
security_priority = 'High'
high_priority_steps = ['Requirements Analysis', 'Design', 'Testing']
# Create the summary string with the exact text
# Your code here

Hint

Assign the exact sentence to the variable summary.

Practice

1. What is the main goal of Secure SDLC (Software Development Life Cycle)?

easy

A. To focus only on fixing bugs after software release

B. To speed up software development by skipping testing

C. To integrate security measures throughout the software development process

D. To design software without considering user needs

Solution

1. Step 1: Understand the purpose of Secure SDLC

   Secure SDLC aims to include security at every stage of software creation, not just at the end.

2. Step 2: Compare options with this goal

   Only To integrate security measures throughout the software development process describes integrating security throughout the process, which matches the goal.

3. Final Answer:

   To integrate security measures throughout the software development process -> Option C

4. Quick Check:

   Secure SDLC = Integrate security [OK]

Hint: Secure SDLC means adding security from start to finish [OK]

Common Mistakes:

• Thinking security is only for testing phase
• Believing Secure SDLC speeds up development by skipping steps
• Assuming Secure SDLC ignores user needs

2. Which of the following is a correct practice in Secure SDLC during the development phase?

easy

A. Performing static code analysis to find vulnerabilities

B. Ignoring code reviews to save time

C. Skipping security testing until after deployment

D. Allowing unrestricted access to source code

Solution

1. Step 1: Identify secure development practices

   Static code analysis helps find security issues early in development.

2. Step 2: Evaluate each option

   Performing static code analysis to find vulnerabilities is a known secure practice; others ignore security or increase risk.

3. Final Answer:

   Performing static code analysis to find vulnerabilities -> Option A

4. Quick Check:

   Development phase = Static code analysis [OK]

Hint: Use static code analysis during development [OK]

Common Mistakes:

• Skipping code reviews thinking they waste time
• Delaying security testing until after deployment
• Not protecting source code access

3. Consider this simplified Secure SDLC checklist code snippet:

phases = ['Planning', 'Design', 'Development', 'Testing', 'Deployment']
security_checks = {'Planning': True, 'Design': True, 'Development': False, 'Testing': True, 'Deployment': True}
secure_phases = [phase for phase in phases if security_checks.get(phase)]
print(secure_phases)

What will be the output?

medium

A. []

B. ['Planning', 'Design', 'Development', 'Testing', 'Deployment']

C. ['Development']

D. ['Planning', 'Design', 'Testing', 'Deployment']

Solution

1. Step 1: Understand the list comprehension filtering

   The code selects phases where security_checks is True.

2. Step 2: Check each phase's security status

   'Development' is False, so it is excluded; others are True and included.

3. Final Answer:

   ['Planning', 'Design', 'Testing', 'Deployment'] -> Option D

4. Quick Check:

   Filter True phases = ['Planning', 'Design', 'Testing', 'Deployment'] [OK]

Hint: Filter list by True values in dictionary [OK]

Common Mistakes:

• Including phases with False security checks
• Confusing list comprehension syntax
• Assuming all phases are included

4. A developer wrote this code to check if all SDLC phases have security checks:

phases = ['Planning', 'Design', 'Development', 'Testing', 'Deployment']
security_checks = {'Planning': True, 'Design': True, 'Development': False, 'Testing': True, 'Deployment': True}
all_secure = all(security_checks[phase] for phase in phases)
print(all_secure)

What is the output and why?

medium

A. True, because most phases have security checks

B. False, because 'Development' phase lacks security checks

C. Error, because of incorrect dictionary access

D. None, because the variable is not assigned

Solution

1. Step 1: Understand the all() function usage

   all() returns True only if every item is True; here it checks each phase's security status.

2. Step 2: Check security status for each phase

   'Development' is False, so all() returns False.

3. Final Answer:

   False, because 'Development' phase lacks security checks -> Option B

4. Quick Check:

   all() with one False = False [OK]

Hint: all() is False if any item is False [OK]

Common Mistakes:

• Assuming all() returns True if most are True
• Thinking dictionary access causes error here
• Confusing all() with any()

5. You want to improve security in the SDLC by adding automated security testing after development and before deployment. Which practice best fits this goal?

hard

A. Integrate continuous security testing tools in the CI/CD pipeline

B. Perform manual security reviews only after deployment

C. Skip testing to speed up deployment

D. Allow developers to decide if security testing is needed

Solution

1. Step 1: Identify the goal of adding automated security testing

   The goal is to catch security issues early and continuously during development.

2. Step 2: Evaluate options for fitting this goal

   Integrate continuous security testing tools in the CI/CD pipeline uses automated tools integrated in CI/CD, ensuring continuous checks before deployment.

3. Final Answer:

   Integrate continuous security testing tools in the CI/CD pipeline -> Option A

4. Quick Check:

   Automated testing in CI/CD = Best practice [OK]

Hint: Use automated tests in CI/CD for continuous security [OK]

Common Mistakes:

• Relying only on manual reviews after deployment
• Skipping testing to save time
• Leaving security testing optional