Secure SDLC models

SDLC models include waterfall, spiral, agile, and agile combined with DevOps practices, and few of them address security in detail, so secure practices must be integrated into whichever model is used. DevSecOps incorporates security early and integrates and automates security processes and tooling into the whole DevOps workflow, using automated CI/CD pipelines that take software from build through deployment and operations. Know that "shifting left" means addressing security earlier in the lifecycle, which takes less effort and cost for the same level of security, not just adding more checks at the end.[1][2][3][18]

Injection vulnerabilities

SQL injection, OS command injection, and LDAP injection all stem from the same root cause: untrusted input sent to an interpreter and executed as part of a command or query, typically because it was concatenated into a dynamic query. The defense is the same too: keep data separate from commands with a parameterized interface.[4][5][6]

OWASP Top 10 concepts

The OWASP Top 10:2025 includes broken access control (A01), cryptographic failures (A04), injection (A05), and insecure design (A06), alongside security misconfiguration and software supply chain failures. Learn the underlying vulnerability classes, not just the branded list, since a scenario can describe the flaw without naming OWASP.[7]

Database security

The primary defenses against SQL injection are parameterized queries, properly constructed stored procedures, and allow-list input validation; SQL views add least privilege by limiting reads to specific fields or joins. Understand aggregation (a collection of items that is more sensitive than any single item) and inference (deducing sensitive data by correlating query responses with what is already known) as database-specific confidentiality risks.[8][9][10][11]

Software escrow

Source code held by a third-party escrow agent so the customer can obtain, use, and modify the software if the vendor is unable or unwilling to maintain it (for example, because it has gone out of business). It is a contractual risk-mitigation tool for acquired software, and bank examiners check that the escrow agent has confirmed the current version of the code is held.[13]

Input validation vs. sanitization vs. encoding

Validation ensures only properly formed data enters the workflow; it helps, but it is not the primary defense against XSS or SQL injection. Sanitization strips dangerous content (such as dangerous HTML) and returns a safe version. Output encoding converts untrusted input into a safe form that is displayed as data instead of executing as code in the browser, and OWASP lists encoding methods as critical to stopping XSS whenever you display user data. These are complementary, not interchangeable, defenses.[14][15][16][19]

Aggregation vs. inference (database security)

Aggregation is when a collection of individually lower-sensitivity items is more sensitive, and must be classified higher, than any item on its own. Inference is indirectly gaining sensitive information by correlating query responses (for example, statistical summaries) with information already known. Aggregation is about the combined collection; inference is about deducing what you were never given.[10][11][12]