# data[].attributes.body
• Identificar y documentar requisitos de seguridad funcionales y no funcionales: autenticación, autorización, cifrado.

• Realizar Análisis de Riesgos y Evaluación de Amenazas.

• Priorizar controles según nivel de riesgo.

Recurso:

🔗 “What is Secure SDLC?” (Wiz).

# data[].attributes.attachment_link.description
Secure SDLC (SSDLC) is a framework for enhancing software security by integrating security designs, tools, and processes across the entire dev lifecycle.

# data[].attributes.body
• Usar OWASP Secure Coding Practices (input validation, output encoding, gestión de sesiones, etc.).

• Gestionar dependencias con Software Composition Analysis (SCA).

• Mantener librerías y frameworks actualizados.

Recurso:

📄 OWASP Secure Coding Practices (quick reference guide)

# data[].attributes.attachment_link.title
OWASP Secure Coding Practices - Quick Reference Guide | Secure Coding Practices | OWASP Foundation

# data[].attributes.attachment_link.description
Secure Coding Practices on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

# data[].attributes.body
• Automatizar SAST en cada commit (GitHub Actions, GitLab CI, Jenkins).

• Revisiones manuales con checklist OWASP.

• Bloquear merging si hay vulnerabilidades críticas.

Recurso:

🎥 Vídeo de ejemplo de pipeline CI/CD con SAST/DAST.

# data[].attributes.headline
5. Pruebas de Penetración (DAST & Pentesting)

# data[].attributes.subject
5. Pruebas de Penetración (DAST & Pentesting)

# data[].attributes.body
• Ejecutar escaneo dinámico (DAST) en entorno de staging.

• Programar pentests manuales periódicos (internos o externos).

• Documentar hallazgos y asignar acciones correctivas.

Recurso:

🎥 “How to Implement the Secure Software Development Lifecycle”.

# data[].attributes.attachment_link.title
How to Implement the Secure Software Development Lifecycle (SSDLC) in DevSecOps at Organisations

# data[].attributes.headline
6. Integración Continua & Entrega Continua (CI/CD)

# data[].attributes.subject
6. Integración Continua & Entrega Continua (CI/CD)

# data[].attributes.body
• Incluir escaneos de seguridad (SAST, DAST, dependencia) en cada build.

• Configurar gates que bloqueen despliegues con fallos de seguridad.

• Validar contenedores (Docker scan, K8s policies).

Recurso:

📊 Diagrama SSDLC completo (SlideShare)

# data[].attributes.attachment_link.title
Lecture Course Outline and Secure SDLC.ppt

# data[].attributes.attachment_link.description
Lecture Course Outline and Secure SDLC.ppt - Download as a PDF or view online for free

# data[].attributes.headline
7. Monitoreo y Retroalimentación (RASP & Logs)

# data[].attributes.subject
7. Monitoreo y Retroalimentación (RASP & Logs)

# data[].attributes.body
• Implementar Runtime Application Self-Protection (RASP).

• Centralizar logs de seguridad y alertas (SIEM).

• Cerrar el ciclo: enviar lecciones aprendidas a fases de diseño y codificación.

Recurso:

🎧 Podcast SE-Radio 658: Tanya Janca sobre Secure Coding.

# data[].attributes.attachment_link.title
SE Radio 658: Tanya Janca on Secure Coding

# data[].attributes.attachment_link.description
Podcast Episode · Software Engineering Radio - the podcast for professional software developers · 03/06/2025 · 1h 12m

# data[].attributes.body
• Aplicar patrones de arquitectura seguros (ej. MVC con capas de validación).

• Crear Data Flow Diagrams (DFD) y límites de confianza.

• Identificar amenazas con STRIDE.

🖼️ Diagrama de Threat Modeling (Threat Tree).

📄 Guía paso a paso: OWASP Threat Modeling Cheat Sheet

https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html :contentReference[oaicite:2]{index=2}

# data[].attributes.attachment_link.title
Threat Modeling Process | OWASP Foundation

# data[].attributes.attachment_link.description
Threat Modeling Process on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

# data[].attributes.body
AppSec101. (2019). What makes a secure SDLC? | AppSec 101 [Video]. YouTube. https://www.youtube.com/watch?v=MHhHrztQ-Cw

Hernández, M. (2020). Ciclo de vida de desarrollo ágil de software seguro (pp. 39–102). Fundación Universitaria Los Libertadores.

Infosec. (2018). How to Implement the Secure Software Development Lifecycle [Video]. YouTube. https://www.youtube.com/watch?v=tXCQ4HagtJw

Ortega, J. (2018). Seguridad en aplicaciones Web Java (pp. 268–294). RA-MA Editorial.

OWASP. (n.d.-a). Secure Coding Practices – Quick Reference Guide. OWASP Project. Retrieved June 15, 2025, from https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/stable-en/

OWASP. (n.d.-b). Threat Modeling Cheat Sheet. OWASP Cheat Sheet Series. Retrieved June 15, 2025, from https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html

OWASP. (n.d.-c). Threat Modeling Process. OWASP. Retrieved June 15, 2025, from https://owasp.org/www-community/Threat_Modeling_Process

Slideshare. (n.d.). Lecture Course Outline and Secure SDLC [PowerPoint slides]. SlideShare. Retrieved June 15, 2025, from https://www.slideshare.net/slideshow/lecture-course-outline-and-secure-sdlcppt/259163056

Software Engineering Radio. (n.d.). SE-Radio 658: Tanya Janca on Secure Coding [Audio podcast episode]. Retrieved June 15, 2025, from https://podcasts.apple.com/us/podcast/se-radio-658-tanya-janca-on-secure-coding/id120906714?i=1000697986971

Wiz. (n.d.). What is Secure SDLC? Wiz Academy. Retrieved June 15, 2025, from https://www.wiz.io/academy/secure-sdlc