What is the purpose of a secure Software Development Lifecycle (SDLC) model?

• A. To accelerate development without security
• B. To document security requirements
• C. To outsource security testing
• D. To integrate security into each phase of software development from design to deployment

Answer: (D)

Integrating security into every stage of software development so security controls are considered from design through deployment. A secure SDLC treats security as a core part of the process, not a final add-on, so threats are identified and mitigated early and continuously as the software evolves. This means defining security requirements upfront, modeling threats, designing with secure principles, following secure coding practices, performing code reviews and security testing (static and dynamic analysis), and ensuring secure deployment and ongoing vulnerability management after release. The idea is to shift security left—addressing it in design, implementation, and validation—to reduce risk and cost compared to dealing with security only at the end.

Why the other ideas don’t fit as the primary purpose: rushing development without security ignores risk and undermines the goal of a secure product. Relying on outsourcing security testing alone misses the continuous integration of security across all phases. While documenting security requirements is important, the secure SDLC emphasizes embedding security throughout the entire development lifecycle, not just capturing requirements in a separate step.