D487 – SDL Templates Exercise
Instructions: Complete the following tables for each stage of the SDL. The material is
summarized in Chapters 3 – 8 of the course textbook.
Security Assessment (A1): SDL Activities and Best Practices
Activities
Software team is looped in early
Identify business, security, privacy, and compliance requirements.
De ne the product risk pro le and likely threat exposure.
Set security objectives, roles, and approval checkpoints.
Key Success Factors
Key Success Factor Description
Early security involvement Security work starts during planning instead of
being delayed until testing.
Clear requirements The team documents security, privacy, and
compliance needs before design begins.
Risk-based focus Higher-risk features and data are identi ed so
effort goes where it matters most.
Shared ownership Developers, architects, testers, and leaders
know their security duties.
De ned entry criteria The project has a security plan, milestones,
and approval gates before moving forward.
Key Deliverables
Deliverable Goal
Security requirements list Captures the security and privacy controls the product must
meet.
Product risk pro le Summarizes likely threats, data sensitivity, exposure, and
business impact.
Compliance checklist Maps the product to policies, laws, standards, and internal
rules.
fi fi fi fi
, Initial threat assumptions Lists the main attack paths that must be studied later.
Security roles matrix Shows who approves, reviews, tests, and responds to
issues.
SDL work plan Schedules the security tasks, tools, and reviews for the rest
of development.
Success criteria De nes what must be true before the project can leave the
assessment stage.
Metrics at this stage of the SDL
Percent of projects with security included during planning
Number of security requirements identi ed
Number of high-risk features or data ows identi ed
Percent of required roles assigned and acknowledged
Architecture (A2): SDL Activities and Best Practices
Activities
Create and review the system architecture.
Model trust boundaries, data ows, assets, and attack surfaces.
Perform threat modeling using a structured method such as STRIDE or PASTA.
Identify security controls for authentication, authorization, logging, and encryption.
Review external dependencies, integrations, and third-party components.
Key Success Factors
Key Success Factor Description
Clear architecture visibility The team understands components,
interfaces, data movement, and trust
boundaries.
Useful threat modeling Threat modeling is practical, current, and tied
to the real design.
Control selection Security controls are chosen to reduce the
most serious risks.
fi
fl fl fi fi
Instructions: Complete the following tables for each stage of the SDL. The material is
summarized in Chapters 3 – 8 of the course textbook.
Security Assessment (A1): SDL Activities and Best Practices
Activities
Software team is looped in early
Identify business, security, privacy, and compliance requirements.
De ne the product risk pro le and likely threat exposure.
Set security objectives, roles, and approval checkpoints.
Key Success Factors
Key Success Factor Description
Early security involvement Security work starts during planning instead of
being delayed until testing.
Clear requirements The team documents security, privacy, and
compliance needs before design begins.
Risk-based focus Higher-risk features and data are identi ed so
effort goes where it matters most.
Shared ownership Developers, architects, testers, and leaders
know their security duties.
De ned entry criteria The project has a security plan, milestones,
and approval gates before moving forward.
Key Deliverables
Deliverable Goal
Security requirements list Captures the security and privacy controls the product must
meet.
Product risk pro le Summarizes likely threats, data sensitivity, exposure, and
business impact.
Compliance checklist Maps the product to policies, laws, standards, and internal
rules.
fi fi fi fi
, Initial threat assumptions Lists the main attack paths that must be studied later.
Security roles matrix Shows who approves, reviews, tests, and responds to
issues.
SDL work plan Schedules the security tasks, tools, and reviews for the rest
of development.
Success criteria De nes what must be true before the project can leave the
assessment stage.
Metrics at this stage of the SDL
Percent of projects with security included during planning
Number of security requirements identi ed
Number of high-risk features or data ows identi ed
Percent of required roles assigned and acknowledged
Architecture (A2): SDL Activities and Best Practices
Activities
Create and review the system architecture.
Model trust boundaries, data ows, assets, and attack surfaces.
Perform threat modeling using a structured method such as STRIDE or PASTA.
Identify security controls for authentication, authorization, logging, and encryption.
Review external dependencies, integrations, and third-party components.
Key Success Factors
Key Success Factor Description
Clear architecture visibility The team understands components,
interfaces, data movement, and trust
boundaries.
Useful threat modeling Threat modeling is practical, current, and tied
to the real design.
Control selection Security controls are chosen to reduce the
most serious risks.
fi
fl fl fi fi
