Lesson 6.5: Secure development and code review
Finding vulnerabilities in production is the most expensive place to find them. A secure development lifecycle moves security earlier: security requirements, threat modelling (STRIDE), secure defaults in frameworks, code review, automated checks in the build pipeline (linting, SAST, SCA, secret scanning, DAST) and standards such as OWASP ASVS. In the lab a contractor's pull request adds a gift card page and asks to be merged before Friday. You review it like a security engineer: let PHP lint it, search it for the risky patterns from this course, and write a review that names each problem and its fix.
17 min
You will learn to
- Explain the idea of a secure development lifecycle
- Use STRIDE to think about threats
- Review code for the vulnerability patterns in this course
- Name automated checks for a build pipeline
- Write review findings with a fix for each
Key terms
- Secure development lifecycle (SDLC)
- Security activities at every stage of building software: requirements, design, coding, testing, release and operation.
- Threat modelling
- Looking at a design before building it and asking what can go wrong, then deciding what to do about each threat.
- OWASP ASVS
- The Application Security Verification Standard: a detailed list of security requirements to design, build and test against, in three levels.
- SAST
- Tools that analyse source code without running it, looking for vulnerable patterns.
- DAST
- Tools that test the running application from outside by sending requests, like an attacker would.
- Secret scanning
- Automatically searching code and commits for passwords, keys and tokens before they're pushed or published.
← Discovering hosts and services with nmap, within scope · All lessons · Anonymity, privacy and digital traces →