Secure development lifecycle

This article is part of a series on
Information security
Related security categories
Internet security Cyberwarfare Computer security Mobile security Network security
Threats
Computer crime Vulnerabilities Eavesdropping Malware Spyware Ransomware Trojans Viruses Worms Rootkits Bootkits Keyloggers Screen scrapers Exploits Backdoors Logic bombs Payloads Denial of service Web shells
Defenses
Computer access control Application security Antivirus software Secure coding Secure by default Secure by design Secure operating systems Authentication Multi-factor authentication Authorization Data-centric security Encryption Firewall Intrusion detection system Mobile secure gateway Runtime application self-protection (RASP)

In information security, a Secure Development Lifecycle or SDLC is a type of specialized software development process that describes how the security guarantees of software are ensured and maintained. SDLCs can differ greatly in their approach to securing software, including components like security training, security incident response, security-focused static program analysis and Threat Modelling.

History

In 2002, Bill Gates, as CEO of Microsoft sent the "Trustworthy Computing" memo, which changed the way that Microsoft approached software development, saying "...when we face a choice between adding features and resolving security issues, we need to choose security.". The previous year, more than 300,000 computers were infected with a virus named Code Red.. The outcome of this letter was the creation of the first formal Secure Development Lifecycle program in the form of the Microsoft Security Development Lifecycle.

References

This article "Secure development lifecycle" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Secure development lifecycle. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---