Explain secure software development lifecycle (SSDLC) and its integration into enterprise architecture.

Explain secure software development lifecycle (SSDLC) and its integration into enterprise architecture.

• A. SSDLC embeds security into each phase of software development, from requirements to deployment, ensuring secure coding practices, vulnerability management, and ongoing assurance.
• B. SSDLC focuses only on the testing phase.
• C. SSDLC replaces enterprise architecture governance.
• D. SSDLC is only for producing secure hardware.

Answer: (B)

SSDLC is about building security into every step of software creation, from planning and requirements through design, coding, testing, deployment, and ongoing maintenance. It means applying secure design principles, threat modeling, secure coding practices, code reviews, and rigorous security testing (static, dynamic, and interactive), along with vulnerability management and timely remediation. In an enterprise architecture context, this approach isn’t isolated to developers; it’s coordinated with governance, risk management, and security services across the organization. That integration ensures security requirements are baked into architectural patterns, data protection, identity and access management, and monitoring, so security risks are reduced early and continuously managed as the software evolves. Describing SSDLC as focusing only on the testing phase misses the breadth of activities that prevent vulnerabilities from being created in the first place and ensures ongoing assurance after deployment. The strongest view is that SSDLC spans the full lifecycle and aligns with the broader enterprise architecture to maintain consistent security across applications and services.

SSDLC is about building security into every step of software creation, from planning and requirements through design, coding, testing, deployment, and ongoing maintenance. It means applying secure design principles, threat modeling, secure coding practices, code reviews, and rigorous security testing (static, dynamic, and interactive), along with vulnerability management and timely remediation. In an enterprise architecture context, this approach isn’t isolated to developers; it’s coordinated with governance, risk management, and security services across the organization. That integration ensures security requirements are baked into architectural patterns, data protection, identity and access management, and monitoring, so security risks are reduced early and continuously managed as the software evolves.

Describing SSDLC as focusing only on the testing phase misses the breadth of activities that prevent vulnerabilities from being created in the first place and ensures ongoing assurance after deployment. The strongest view is that SSDLC spans the full lifecycle and aligns with the broader enterprise architecture to maintain consistent security across applications and services.