Secure Software Design (D487)
In-Depth Study Guide
Subtitle: Based on Practical Core Software Security - A Reference Framework
Format: Chapter-by-Chapter Breakdown with Exam Readiness, Terminology, Threat Models, Deliverables, and
Real-World Applications
Chapter 1: Introduction
• - Differences between software security and application security
• - Secure code vs quality code
• - CIA Triad with definitions, examples, and violations
• - Threat modeling overview (STRIDE, DREAD, DFDs, trust boundaries)
• - Attack surface validation: entry/exit points, expansion via feature additions
Chapter 2: The Security Development Lifecycle (SDL)
• - SDL vs SDLC distinction
• - SDL phases mapped to SDLC phases
• - Maturity models: BSIMM vs OpenSAMM
• - ISO/IEC 27034 standard
• - Tools and talent (SAST, DAST, manual reviews, SDL roles)
• - Principle of Least Privilege and privacy integration
• - Metrics: vulnerabilities caught pre-release, time to patch, training coverage
Chapter 3: Security Assessment (SDL Phase A1)
• - Discovery session outcomes and stakeholders
• - PIA planning, privacy questions, initial risk classification
• - SDL Project Outline, Product Risk Profile, Threat Profile
• - Metrics Template deliverable
Chapter 4: Architecture (SDL Phase A2)
• - Policy compliance analysis with internal/external controls
• - Threat modeling artifacts (DFDs, STRIDE threat mapping, data classification)
• - Architecture Threat Analysis and mitigation planning
• - Open-source evaluation (licensing, vulnerability exposure)
• - Privacy information gathering
,Chapter 5: Design & Development (SDL Phase A3)
• - Updated threat modeling and DFDs
• - Static analysis tool configuration
• - Security test plan composition (roles, tools, coverage)
• - Privacy implementation assessments
• - Updated policy compliance check
Chapter 6: Design & Development (Continued) (SDL Phase A4)
• - Security test execution report
• - Fuzz testing strategies and tools
• - Remediation report to track status
• - Privacy compliance validation
• - Test result mapping to ownership and patch cycles
Chapter 7: Ship (SDL Phase A5)
• - Final Security Review (FSR) and release readiness
• - Penetration testing and environment hardening
• - Open-source licensing compliance (GPL, MIT, etc.)
• - Final Privacy Review: encryption, consent, retention
• - Customer Engagement Framework: disclosures, FAQs, trust messaging
Chapter 8: Post-Release Security Activities (PRSA)
• - PRSA1: PSIRT team handling, CVSS scoring, vuln response
• - PRSA2: 3rd-party security reviews and audits
• - PRSA3: Post-release certifications (SOC2, FedRAMP)
• - PRSA4: Reapplying SDL to reused/modified code
• - PRSA5: M&A, legacy, and EOL product security strategy
Chapter 9: BSIMM (Building Security In Maturity Model)
• - Observational model for benchmarking security maturity
• - 4 Domains: Governance, Intelligence, SSDL Touchpoints, Deployment
• - 12 Practices across 112 activities
• - BSIMM vs OpenSAMM (observed vs prescriptive)
• - How BSIMM supports secure culture, budget requests, and maturity tracking
Chapter 10: Software Security Roadmap
• - Strategic alignment of SDL goals with business objectives
• - Milestone planning: secure coding rollout, threat model adoption, DevSecOps integration
• - Phased execution: Crawl → Walk → Run approach
,• - Security roadmap as a living document: adapts to org maturity, tech shifts, and regulation
• - Importance of leadership buy-in and cultural embedding
• - Common roadmap initiatives: SDL automation, role-based training, policy evolution
• - Roadmap metrics: progress tracking, risk reduction, policy adherence
• - Aligning roadmap outcomes to compliance frameworks (ISO, NIST, SOC2)
Chapter 1: Introduction
“The best security is built in, not bolted on.” — Foundational principle
Learning Outcomes
By the end of this chapter, you should be able to:
• Explain the difference between software security and application security.
• Define and apply the CIA Triad.
• Understand the critical role of SDL inside the SDLC.
• Break down the role and phases of threat modeling.
• Recognize the difference between secure and quality code.
• Identify how attack surface validation works and when it's done.
Test Insight: Several preliminary questions and Discord tips confirm this chapter sets up key terminology,
frameworks, and distinctions—especially SDL vs SDLC, threat modeling, and the CIA Triad.
1.1 Why Software Security Matters
Key Insight:
Software is now the core of all critical infrastructures (e.g., defense, energy, finance). Unlike networks, software
vulnerabilities are baked in during design and implementation—often invisible until exploited.
• Attacks on software systems are now:
o Remote
o Automated
o Scalable
o Inexpensive
Real-World Relevance:
• Log4j, SolarWinds, and Apache Struts were exploited not because of poor network security, but because of
insecure code in software supply chains.
, Test Angle: “Why is it important to address software security during development?”
Because later-stage fixes are more expensive, harder to test, and less effective.
1.2 SDL vs SDLC: A Crucial Distinction
Concept SDLC SDL
Focus Development steps Embedded security activities
Phases Requirements → Maintenance Assessment → Release + PRSA
Goal Functional software Resilient software
• SDL is embedded within the SDLC.
• SDL phases overlay every traditional SDLC methodology (Agile, Waterfall, DevOps).
• Security must evolve with dev methodology. Example:
o Waterfall → plan security up front.
o Agile → execute security controls every sprint (e.g., "Every-sprint requirements").
Terminology Watch:
"SDL is not a replacement for SDLC. It's a security overlay that ensures the development process results in software
that is secure by design."
1.3 Secure Code ≠ Quality Code
Quality Code Secure Code
Maintainable Resistant to attacks
Tested for functionality Tested against threats
Meets requirements Enforces CIA, privacy, access control
Test Trap: “Which type of code handles user input properly but fails when exposed to threat modeling?”
Likely a quality code example, not secure.
Bottom Line:
• High-quality code can still be insecure.
• Secure code must include boundary checks, least privilege, safe defaults, etc.
1.4 The CIA Triad
The CIA Triad is the most fundamental principle in all of cybersecurity.
In-Depth Study Guide
Subtitle: Based on Practical Core Software Security - A Reference Framework
Format: Chapter-by-Chapter Breakdown with Exam Readiness, Terminology, Threat Models, Deliverables, and
Real-World Applications
Chapter 1: Introduction
• - Differences between software security and application security
• - Secure code vs quality code
• - CIA Triad with definitions, examples, and violations
• - Threat modeling overview (STRIDE, DREAD, DFDs, trust boundaries)
• - Attack surface validation: entry/exit points, expansion via feature additions
Chapter 2: The Security Development Lifecycle (SDL)
• - SDL vs SDLC distinction
• - SDL phases mapped to SDLC phases
• - Maturity models: BSIMM vs OpenSAMM
• - ISO/IEC 27034 standard
• - Tools and talent (SAST, DAST, manual reviews, SDL roles)
• - Principle of Least Privilege and privacy integration
• - Metrics: vulnerabilities caught pre-release, time to patch, training coverage
Chapter 3: Security Assessment (SDL Phase A1)
• - Discovery session outcomes and stakeholders
• - PIA planning, privacy questions, initial risk classification
• - SDL Project Outline, Product Risk Profile, Threat Profile
• - Metrics Template deliverable
Chapter 4: Architecture (SDL Phase A2)
• - Policy compliance analysis with internal/external controls
• - Threat modeling artifacts (DFDs, STRIDE threat mapping, data classification)
• - Architecture Threat Analysis and mitigation planning
• - Open-source evaluation (licensing, vulnerability exposure)
• - Privacy information gathering
,Chapter 5: Design & Development (SDL Phase A3)
• - Updated threat modeling and DFDs
• - Static analysis tool configuration
• - Security test plan composition (roles, tools, coverage)
• - Privacy implementation assessments
• - Updated policy compliance check
Chapter 6: Design & Development (Continued) (SDL Phase A4)
• - Security test execution report
• - Fuzz testing strategies and tools
• - Remediation report to track status
• - Privacy compliance validation
• - Test result mapping to ownership and patch cycles
Chapter 7: Ship (SDL Phase A5)
• - Final Security Review (FSR) and release readiness
• - Penetration testing and environment hardening
• - Open-source licensing compliance (GPL, MIT, etc.)
• - Final Privacy Review: encryption, consent, retention
• - Customer Engagement Framework: disclosures, FAQs, trust messaging
Chapter 8: Post-Release Security Activities (PRSA)
• - PRSA1: PSIRT team handling, CVSS scoring, vuln response
• - PRSA2: 3rd-party security reviews and audits
• - PRSA3: Post-release certifications (SOC2, FedRAMP)
• - PRSA4: Reapplying SDL to reused/modified code
• - PRSA5: M&A, legacy, and EOL product security strategy
Chapter 9: BSIMM (Building Security In Maturity Model)
• - Observational model for benchmarking security maturity
• - 4 Domains: Governance, Intelligence, SSDL Touchpoints, Deployment
• - 12 Practices across 112 activities
• - BSIMM vs OpenSAMM (observed vs prescriptive)
• - How BSIMM supports secure culture, budget requests, and maturity tracking
Chapter 10: Software Security Roadmap
• - Strategic alignment of SDL goals with business objectives
• - Milestone planning: secure coding rollout, threat model adoption, DevSecOps integration
• - Phased execution: Crawl → Walk → Run approach
,• - Security roadmap as a living document: adapts to org maturity, tech shifts, and regulation
• - Importance of leadership buy-in and cultural embedding
• - Common roadmap initiatives: SDL automation, role-based training, policy evolution
• - Roadmap metrics: progress tracking, risk reduction, policy adherence
• - Aligning roadmap outcomes to compliance frameworks (ISO, NIST, SOC2)
Chapter 1: Introduction
“The best security is built in, not bolted on.” — Foundational principle
Learning Outcomes
By the end of this chapter, you should be able to:
• Explain the difference between software security and application security.
• Define and apply the CIA Triad.
• Understand the critical role of SDL inside the SDLC.
• Break down the role and phases of threat modeling.
• Recognize the difference between secure and quality code.
• Identify how attack surface validation works and when it's done.
Test Insight: Several preliminary questions and Discord tips confirm this chapter sets up key terminology,
frameworks, and distinctions—especially SDL vs SDLC, threat modeling, and the CIA Triad.
1.1 Why Software Security Matters
Key Insight:
Software is now the core of all critical infrastructures (e.g., defense, energy, finance). Unlike networks, software
vulnerabilities are baked in during design and implementation—often invisible until exploited.
• Attacks on software systems are now:
o Remote
o Automated
o Scalable
o Inexpensive
Real-World Relevance:
• Log4j, SolarWinds, and Apache Struts were exploited not because of poor network security, but because of
insecure code in software supply chains.
, Test Angle: “Why is it important to address software security during development?”
Because later-stage fixes are more expensive, harder to test, and less effective.
1.2 SDL vs SDLC: A Crucial Distinction
Concept SDLC SDL
Focus Development steps Embedded security activities
Phases Requirements → Maintenance Assessment → Release + PRSA
Goal Functional software Resilient software
• SDL is embedded within the SDLC.
• SDL phases overlay every traditional SDLC methodology (Agile, Waterfall, DevOps).
• Security must evolve with dev methodology. Example:
o Waterfall → plan security up front.
o Agile → execute security controls every sprint (e.g., "Every-sprint requirements").
Terminology Watch:
"SDL is not a replacement for SDLC. It's a security overlay that ensures the development process results in software
that is secure by design."
1.3 Secure Code ≠ Quality Code
Quality Code Secure Code
Maintainable Resistant to attacks
Tested for functionality Tested against threats
Meets requirements Enforces CIA, privacy, access control
Test Trap: “Which type of code handles user input properly but fails when exposed to threat modeling?”
Likely a quality code example, not secure.
Bottom Line:
• High-quality code can still be insecure.
• Secure code must include boundary checks, least privilege, safe defaults, etc.
1.4 The CIA Triad
The CIA Triad is the most fundamental principle in all of cybersecurity.
