AdvancedTopic 88 of 104Software & Computing
Secure software development
Threat modelling, least privilege and dependency hygiene.
In depth
Security is built through the lifecycle: threat modelling, secure design, code review, SAST/DAST/SCA scanning, dependency management (SBOM), secrets management, secure defaults, logging and incident response. Shift left to find issues early. Culture and training are crucial.
Key points
- DevSecOps
- Least privilege
- Supply-chain security
ExampleA CI pipeline scans dependencies for known vulnerabilities on every build.
What is Secure software development?
Threat modelling, least privilege and dependency hygiene.
Why is it important to understand secure software development?
Secure development builds security into the process from the start, which is cheaper and more effective than fixing problems later.
What is threat modelling?
A structured way to identify what could go wrong, who might attack, and which controls reduce the risk.
What does least privilege mean?
Giving each user or program only the access needed for its task, so a compromise does less damage.
How is Secure software development used in practice?
Typical applications include modelling the threats to a new device before choosing its architecture, applying least privilege so a service only has the permissions it needs and checking third-party libraries for known vulnerabilities before release.
What should I learn before Secure software development?
Study "Common vulnerabilities" first (topic 87 of 104 in Software & Computing). It covers the groundwork this topic builds on.
What are the key points of Secure software development?
DevSecOps. Least privilege. Supply-chain security.
Can you give an example of Secure software development?
A CI pipeline scans dependencies for known vulnerabilities on every build.
What comes after Secure software development?
The next topic is "Web development", which builds directly on this one.
How difficult is Secure software development?
It is classed as Advanced in Software & Computing (topic 88 of 104). It is an advanced topic. It assumes you are comfortable with the intermediate topics in Software & Computing.