What is the purpose of a secure software development lifecycle (SDLC)?

• A. It incorporates security activities at each phase of software development to reduce vulnerabilities.
• B. It eliminates the need for risk assessments entirely.
• C. It delays security until after deployment to minimize cost.
• D. It focuses solely on performance optimization.

Answer: (A)

The aim is to weave security into every phase of software development so vulnerabilities are identified and mitigated early. By incorporating threat modeling and secure design from the start, applying secure coding practices during implementation, and conducting ongoing security testing—through static analysis, dynamic analysis, and verification throughout development and into deployment—the process makes security a built-in part of how software is created, not an afterthought. This reduces the number of vulnerabilities because issues are found and fixed when they’re cheaper and easier to address, and it strengthens overall resilience to attacks after release. It also supports ongoing risk management and compliance with security requirements through continuous monitoring and updates.

These other ideas miss the point: risk assessments aren’t eliminated—they’re an ongoing part of the process; security isn’t postponed until after deployment, because waiting to secure a system leaves it exposed; and focusing purely on performance optimization ignores the security dimension, which is the core purpose of a secure SDLC.