Question

A cloud development team is adopting a secure SDLC for a new microservices-based SaaS platform. The security architect wants threat modeling to deliver the greatest cost and risk-reduction benefit. At which point in the SDLC should structured threat modeling be introduced to maximize its value?

Accepted Answer

During the design phase, before code is written, so architectural risks and trust boundaries are identified early

Answer

During the implementation phase, alongside SAST scanning of the first code commits

Answer

During the testing phase, so identified threats can be validated against a running build with DAST

Answer

During the deployment phase, after the production architecture and IAM roles are finalized