In a Secure Software Development Life Cycle (Secure SDLC), which phases include security activities?

• A. Requirements, Design, Implementation, Testing, Deployment, and Maintenance.
• B. Only Design and Deployment.
• C. Maintenance only.
• D. Requirements and Testing.

Answer: (A)

Security needs to be part of every stage of the development lifecycle, not just a few isolated points. In a Secure SDLC, you start by capturing security and privacy requirements, risks, and constraints so the project is built with those needs in mind. During design, you model threats and choose architectures and controls that mitigate them. In implementation, secure coding practices, reviews, and defenses are applied to produce safer code. In testing, you actively look for vulnerabilities through security testing, including static and dynamic analysis and potential intrusion attempts. When deploying, you configure systems securely, manage secrets properly, and enforce access controls. In maintenance, you continue vulnerability management, patching, and monitoring to defend against new threats over time. This end-to-end approach minimizes risk by addressing security from the outset and maintaining it through operation, which is why the option that includes all phases is the best fit.