3 Think Like an Attacker: Protecting the SDLC
This chapter covers
- Understanding the who and what of the SDLC
- Learning how a threat actor might attack the first phase of the SDLC
- Approaches to transforming the SDLC into something easier to protect.
In the previous chapter we learned the basics of the System Delivery Lifecycle and how to threat model our example online banking application. We can now apply what we learned to the hypothetical bank that is developing systems like the online banking application, or other systems like commercial banking applications, loan risk models, etc.
3.1 Overview
There are many ways to develop a System Delivery Lifecycle for a bank. To cover a reasonable amount of use cases and examples let’s assume that this is a bank in the middle of a digital transformation. They have some legacy systems built around mainframe technologies that use older programming languages like COBOL and FORTRAN. They also have other systems built on newer, but still not modern cloud native, tech stacks like Java Enterprise running on web application servers like WebSphere and WebLogic. They are modernizing their stack and going through a cloud transformation where they are beginning to build out new systems that run on cloud native platforms like Kubernetes and utilize modern technologies, languages, and frameworks like Go, Rust, Knative, and Quarkus.