Question

A development team is building a new customer-facing web application under an accelerated SDLC. The risk practitioner is asked when security requirements should be formally defined to most cost-effectively reduce the risk of vulnerabilities being embedded in the final product. Which SDLC phase is the BEST point to define these requirements?

Accepted Answer

During the requirements/definition phase, before design begins

Answer

During the coding phase, so developers can apply secure coding rules directly

Answer

During system testing, when vulnerabilities can be detected and fixed

Answer

During deployment, as part of the production hardening checklist