Application Security should be considered during
-
Contract Negotiations
-
Testing phase only
-
Coding Phase only
-
All the phases of SDLC
Security must be integrated throughout the entire Software Development Life Cycle (SDLC). Addressing security early in design and continuing through deployment is more cost-effective and results in more secure applications than late-stage fixes.
Application security is not a bolt-on step — it needs to be considered throughout the entire Software Development Life Cycle (SDLC), from requirements and design through coding, testing, and deployment/maintenance. Treating security as only a coding concern or only a testing concern misses vulnerabilities introduced at other phases, such as insecure design decisions or misconfigurations at deployment.