Varni razvojni cikel (SDLC) vključuje varnost v vsako fazo razvoja programske opreme — od zahtev skozi načrtovanje, pisanje kode, testiranje, uvajanje in vzdrževanje — namesto da bi jo obravnaval kot dodatek. Воsebuje načelo »shift left« in »varnost po načrtu«.
Varnost skozi razvojni cikel
Integrate security into EVERY phase (not just at the end):
REQUIREMENTS → define security requirements; consider compliance
DESIGN → THREAT MODELING; secure architecture; security review of the design
DEVELOPMENT → secure coding practices; code review; SAST in the IDE/CI
TESTING → security testing (SAST, DAST, dependency scanning, pen testing)
DEPLOYMENT → secure configuration; secrets management; hardening
MAINTENANCE → patching, monitoring, incident response, ongoing scanning
→ "shift left" — address security EARLY (cheaper than fixing after a breach).
