Secure Software Development Lifecycle (SSDLC)

I’ve spent pretty much the entire book up to this point talking about specific programming and configuration techniques you can use to help make your applications secure. Now it’s time to talk about how to verify that your applications are, in fact, secure. Let’s start by getting one thing out of the way: adding security after the fact never works well. Starting your security checks right before you go live “just to be sure” ensures that you won’t have enough time to fix more than the most egregious problems, and going live before doing any research means your customers’ information is at risk. As one example, Disney+ was hacked hours after going live.