Menene Secure Development Lifecycle (SDLC)?

Question

Accepted Answer

A **Secure Development Lifecycle (SDLC)** yana haɗa tsaro a kowane mataki na haɓaka software — daga buƙatun har zuwa ƙira, ƙididdiga, gwaji, aiki, da kulawa — maimakon ɗaukar shi azaman wani abu na gida. Yana nuna "shift left" da "tsaro ta ƙira."

## Tsaro ta cikin halittar aiki

```text
Integrate security into EVERY phase (not just at the end):
  REQUIREMENTS → define security requirements; consider compliance
  DESIGN → THREAT MODELING; secure architecture; security review of the design
  DEVELOPMENT → secure coding practices; code review; SAST in the IDE/CI
  TESTING → security testing (SAST, DAST, dependency scanning, pen testing)
  DEPLOYMENT → secure configuration; secrets management; hardening
  MAINTENANCE → patching, monitoring, incident response, ongoing scanning
→ "shift left" — address security EARLY (cheaper than fixing after a breach).
```

## Me yasa shift left

```text
The cost to fix a security flaw GROWS dramatically the later it's found:
  caught in design/code (cheap) << found in testing << exploited in PRODUCTION
  (very expensive: breach, damage, emergency response)
→ Building security in early (vs bolting it on / fixing breaches) is far more effective
  and cheaper.
```

## Ayyuka waɗanda suke goyan bayan SDLC

```text
✓ Security TRAINING for developers; secure coding standards
✓ Automated security in CI/CD (SAST, dependency scanning, secret scanning) → catch per change
✓ Threat modeling and security review at design; security testing before release
✓ Security CHAMPIONS in teams; security as part of "definition of done"
✓ Continuous monitoring, patching, and improvement in production
→ Make security a continuous, integrated part of how software is built (DevSecOps).
```

## Me yasa ya matuwa

Jimlartacciyar ilimin Secure Development Lifecycle ita ce muhimmin ilimi don manyan abokin aiki saboda yana nuna **wacce ta sauran ɗagewa ta hada tsaro cikin haɓaka software** maimakon azaman wani abu na gida, don haka ita ce mahimmancin gina software mai karfi ta jiya.

SDLC yana haɗa tsaro a **kowane mataki** — buƙatun (bayyanar bukatuwa na tsaro), ƙira (modeling barazanar tsaro, ƙira mai karfi), haɓaka (ƙididdiga mai karfi, SAST), gwaji (gwaji na tsaro), aiki (saita mai karfi, girma), da kulawa (gyara, sa jiya, amsa gaida) — yana nuna **"tsaro ta ƙira"** da **"shift left."** Jimlar ilimin wannan hada gida shine mahimmi: tsaro ba shi mataki daya ko kargi kuma ba, amma sha'awa ta ci gaba waɗa da aka kashe ta cikin jiya na gaida.

Jimlar ilimin **me yasa shift left ya matuwa** — cewa jiyya don gyara lahani na tsaro yana girma sasai daidai da dawatin da aka samo shi (kusul a ƙira/code, mai tsada in ba a isa ne a halin aiki tare da keta da amsa {emergency), — yana ba da jiya take kasusuwan tsaro kudi da sa'a don bada tsaro jiya maimakon amsa zuwa keta.

Jimlar ilimin **ayyukan goyan bayan** — horo tsaro da ƙa'idodi don masu haɓaka, **automated tsaro a CI/CD** (SAST, bincika kula, secret scanning sansu bayyani a kowane canja), ƙididdiga barazanar tsaro da bincike tsaro a ƙira, gwaji tsaro kafin saita, jami'ai tsaro da tsaro a "ma'anar gama," da ci gaba saita jiya da gyara — yana nuna yaya SDLC aka aiwatar da shi a aiki (wasu lokuta ana kiransa DevSecOps).

Wannan shine wacce ta sauran hanya ga tsaro waɗa da ƙatakakka ƙungiyoyi ke aiwatarwa.

Tun da gina software mai karfi da fili yana buƙatar haɗa tsaro cikin haɓaka (ba azaman abu ne na gida) da kuma SDLC/shift-left hanya ita ce maigama karfi da kusulta fiye da amsa tsaro, da kuma jimlar ilimin yana nuna wacce ta sauran aiki tsaro, jimlar ilimin Secure Development Lifecycle ita ce ilimin mai sani — hanyar tsaro ta halittu waɗa ta hada tsaro a buɓu, yana nuna security-by-design da shift-left, da nuna gurin tsaro mai girma (DevSecOps) wanda aka ƙira ga manyan abokin aiki wanda ke wani sura yadda ƙungiyoyi ke gina software mai karfi a jiya na haɓaka.