📖 What is Software Development Life Cycle (SDLC)?
The Software Development Life Cycle (SDLC) is a structured process used by the software industry to design, develop, and test high-quality software. It typically includes phases such as requirements analysis, design, implementation, testing, deployment, and maintenance.
"For the CISSP, focus on where security is integrated. Security should be 'shifted left,' meaning integrated into the requirements and design phases."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Software Development Life Cycle (SDLC)?
- ▸ Shift-Left Security: Integrating security early in the requirements and design phases to reduce remediation costs and improve the overall resilience of the application.
- ▸ Development Models: Comparing Waterfall's linear structure with Agile's iterative approach, focusing on how security checkpoints are integrated into different delivery cadences.
- ▸ Security Requirements: Establishing clear security goals and constraints during the analysis phase to ensure protection mechanisms are built-in rather than added later.
- ▸ Testing Methodologies: Utilizing Static Application Security Testing (SAST) for code analysis and Dynamic Application Security Testing (DAST) for runtime vulnerability assessment.
- ▸ Maintenance and Disposal: Managing security patches throughout the operational life of the software and ensuring secure data destruction during the final decommissioning phase.
🎯 How does Software Development Life Cycle (SDLC) appear on the CISSP Exam?
You may be asked to identify the most cost-effective stage to address a security flaw, where the correct answer emphasizes the requirements or design phase to avoid expensive late-stage rework.
A scenario might describe a company moving to a CI/CD pipeline; you will need to determine how to integrate automated security scanning and 'security as code' to maintain speed without sacrificing safety.
Expect questions comparing Waterfall and Agile SDLCs, specifically regarding when security audits occur and how iterative releases affect the overall risk management process, documentation requirements, and final sign-off.
❓ Frequently Asked Questions
Why is 'shifting left' emphasized so heavily in the CISSP exam?
Fixing a vulnerability during the design phase is significantly cheaper and less risky than patching a production system, as it prevents the flaw from being baked into the architecture.
What is the practical difference between SAST and DAST in the SDLC?
SAST analyzes source code without executing it (white-box) to find logic errors, while DAST tests the running application (black-box) to find vulnerabilities like XSS or SQL injection.
How does DevSecOps differ from traditional SDLC security?
DevSecOps integrates security as a shared responsibility throughout the entire pipeline via automation, rather than treating security as a final 'gate' or audit performed just before deployment.