1
Plan & Threat Modeling

Embed security in planning: abuse cases, risk, user stories

Activities

STRIDE, attack trees, risk-based backlogs, security requirements.

Plan
2
Code Security

SAST, SCA, secret scanning, secure code review

Checks

OWASP Top 10, commit signing, branch protections, pre-commit hooks.

Code
3
Build & IaC Security

CI hardening, supply chain, IaC scanning, least-privilege runners

Controls

SBOM, provenance (SLSA), policy-as-code, drift detection.

Build
4
Test & DAST

DAST, API testing, fuzzing, test environment parity

Tests

AuthN/Z tests, rate limiting, negative testing, chaos testing

Test
5
Deploy & Container Security

Container scanning, policies, admission control, secrets injection

Policies

Image signing, SBOM attestations, runtime profiles, eBPF.

Deploy
6
Operate & Monitor

Observability, runtime protection, incident readiness, SLIs/SLOs

Metrics

SIEM/SOAR, alert tuning, runbooks, post-incident reviews.

Operate