Hands-On Security in DevOps

SDL (Security Development Lifecycle)

Microsoft defines the SDL (Security Development Lifecycle) to help developers to build secure software. The security activities in each development phase are shown in the following table:

MS SDL Stages	Security activities
Training	Core security training
Requirements	Establish security requirements Create quality gates/bug bars Perform security and privacy risk assessments
Design	Establish design requirements Perform attack surface analysis reduction Use threat modeling
Implementation	Use approved tools Deprecate unsafe functions Perform static analysis
Verification	Perform dynamic analysis Perform fuzz testing Conduct attack surface review
Release