Awesome-SDLC

KO | EN

gitlite — search

#python #java #python3 #arduino #golang #machine-learning #rust #html #flask #javascript #seismology #nodejs

★ 23 Open GitHub ↗

Collection of resources on building Secure Development Lifecycle

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Awesome SDLC [![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome)
========================
Collection of resources on building Secure Development Lifecycle.

### Contents

TBD

## SDLC variations
- [Microsoft SDLC](https://www.microsoft.com/en-us/sdl)
- [Cisco SDLC](https://www.cisco.com/c/en/us/about/security-center/security-programs/secure-development-lifecycle.html)

Compiled list of useful tools and resources for each of phases derived from Microsoft SDLC

### Phase 1 - Training
This phase includes such practices as:
- Core security training

#### Resources:

- [OWASP Security by Design](https://www.owasp.org/index.php/Security_by_Design_Principles)

Short read on the main principles for designing secure applications.

- [Basics of Web security](https://martinfowler.com/articles/web-security-basics.html) by Cade Cairns and Daniel Somerfield.
  
  "Basic practices which every developer can and should be doing as a matter of course".

- [OWASP Top 10 - 2017](https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project)

The list of most common threats for web applications.

- [OWASP JuiceShop](https://www.owasp.org/index.php/OWASP_Juice_Shop_Project)

A vulnerable website with challenges of differnet difficulty.

### Phase 2 - Requirements
This phase includes such practices as:
- Establishing security and privacy requirements
- Creating quality gates/bars
- Performing security and privacy risk assessments

#### Resources:
- [OWASP Application Security Verification Standard Project](https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project)

Ready-made requirements for most development tasks.

- [OWASP Security Knowledge Framework](https://www.owasp.org/index.php/OWASP_Security_Knowledge_Framework)

Web application that incroporates OWASP ASVS and can help with requirements tracking and following throughout the application lifecyle.

### Phase 3 - Design
This phase includes such practices as:
- Establishing design requirements
- Atack surface analysis reduction
- Threat modeling

#### Resources:

- [Threat modeling - Designing for security](https://www.wiley.com/en-us/Threat+Modeling%3A+Designing+for+Security-p-9781118809990) ($) - book by Adam Shostack

A classic book on doing it right.

- [Microsoft Threat Modeling Tool](https://www.microsoft.com/en-us/download/details.aspx?id=49168)

A classic tool for drawing the model and enumerating threats.

- [Threat modeling toolkit](https://www.youtube.com/watch?v=KGy_KCRUGd4)
  
  An awesome talk on practical threat modeling by Jonathan Marcil, application security engineer at Twitch.

### Phase 4 - Implementation
This phase includes such practices as:
- Using approved tools
- Deprecating unsafe functions
- Performing static analysis

#### Resources:

- [Awesome-static-analysis](https://github.com/mre/awesome-static-analysis)

Awesome list of tools for static analysis - it has it all.

### Phase 5 - Verification
This phase includes such practices as:
- Performing dynamic analysis
- Fuzz testing
- Attack surface review

#### Resources:

- [Owasp ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)

Zed Attack Proxy - a free tool for automated dynamic analysis and much more.

- [Awesome-Fuzzing](https://github.com/secfigo/Awesome-Fuzzing)

Awesome list on everything regarding Fuzzing.

### Phase 6 - Release
This phase includes such practices as:
- Creating an incident response plan
- Conducting final security review
- Certifying release and archive

#### Resources:

### Phase 7 - Response
This phase includes such practices as:
- Executing incident response plan

#### Resources:

Awesome-SDLC

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README