Course 7 - Secure SDLC (Software Development Life Cycle) | Episode 3: Defining, Implementing 20 Controls, and Mitigating OWASP Top 10 in SDL

In this lesson, you’ll learn about: Secure Requirements — SDLC Phase 2 1. Overview of Secure Requirements Definition and Purpose:

• Secure requirements are functional and non-functional security features that a system must meet to protect its users, ensure trust, and maintain compliance.
• They define security expectations during the planning and analysis stage, and are documented in product or business requirements.

Timing and Integration:

• Security requirements should be defined early in planning and design.
• Early integration reduces costly late-stage changes and ensures that security is embedded throughout the SDLC.
• Requirements must be continuously updated to reflect functional changes, compliance needs, and evolving threat landscapes.

Collaboration:

• Requires coordination between business developers, system architects, and security specialists.
• Early risk analysis prevents security flaws from propagating through subsequent stages.

2. The 20 Secure Recommendations The course details 20 key recommendations, each tied to mitigation of common application security risks. These cover input validation, authentication, cryptography, and more. Input and Data Validation

1. Input Validation: Server-side validation using whitelists to prevent injection attacks and XSS.
2. Database Security Controls: Use parameterized queries and minimal privilege accounts to prevent SQL injection and XSS.
3. File Upload Validation: Require authentication for uploads, validate file type and headers, and scan for malware to prevent injection or XML external entity attacks.

Authentication and Session Management 4–11. Authentication & Session Management:

• Strong password policies
• Secure failure handling
• Single Sign-On (SSO) and Multi-Factor Authentication (MFA)
• HTTP security headers
• Proper session invalidation and reverification
  Goal: Prevent broken authentication and session hijacking.

Output Handling and Data Protection

1. Output Encoding: Encode all responses to display untrusted input as data rather than code, mitigating XSS attacks.
2. Data Protection: Validate user roles for CRUD operations to prevent insecure deserialization and unauthorized access.

Memory, Error, and System Management

1. Secure Memory Management: Use safe functions and integrity checks (like digital signatures) to reduce buffer overflow and insecure deserialization risks.
2. Error Handling and Logging: Avoid exposing sensitive information in logs (SSN, credit cards) and ensure auditing is in place to prevent security misconfiguration.
3. System Configuration Hardening: Patch all software, lock down servers, and isolate development from production environments.

Transport and Access Control

1. Transport Security: Use strong TLS (1.2/1.3), trusted CAs, and robust ciphers to protect data in transit.
2. Access Control: Enforce Role-Based or Policy-Based Access Control, apply least privilege, and verify authorization on every request.

General Coding Practices and Cryptography

1. Secure Coding Practices: Protect against CSRF, enforce safe URL redirects, and prevent privilege escalation or phishing attacks.
2. Cryptography: Apply strong, standard-compliant encryption (symmetric/asymmetric) and avoid using vulnerable components.

3. Mitigation Strategy

• Each of the 20 recommendations is directly linked to OWASP Top 10 vulnerabilities.
• Following these recommendations ensures that security is embedded into the SDLC rather than added as an afterthought.
• This phase emphasizes proactive security design, minimizing risk before coding begins.

Produced by:
https://www.podcaistudio.com/