Introduction on Kosli's Software Development Lifecycle

Description #

Supply Chain Compromise encompasses attacks where malicious code or vulnerabilities are introduced through external components that an organisation trusts and uses in its software delivery pipeline. Unlike direct attacks on an organisation’s own systems, supply chain attacks exploit the inherent trust placed in third-party software, making them particularly difficult to detect. A single compromised upstream component can propagate malicious code to thousands of downstream consumers before the compromise is discovered.

The Governance Bottleneck

Mon, 01 Jan 0001 00:00:00 +0000

Why Software Delivery Governance Matters #

The modern world runs on mission-critical software. Organizations building this software face a paradox: they need to move fast to stay competitive, but they also need rigorous governance to manage risk.

Engineering teams have spent over a decade investing in DevOps and cloud technologies, automating their way to multiple deployments per day. Meanwhile, governance processes remain stubbornly manual and slow. A single line of code can require dozens of manual steps, multiple approvals, and weeks of waiting — all while providing little actual risk reduction.

Version Control

Mon, 01 Jan 0001 00:00:00 +0000

Software and configuration are stored in an approved version control system, providing traceability of all changes across all releases.

Artifact Binary Provenance

Mon, 01 Jan 0001 00:00:00 +0000

Every software artefact running in a production system has known provenance, established through cryptographic content-addressable identities.

Deployment Controls

Mon, 01 Jan 0001 00:00:00 +0000

Deployment controls are enforced in the pipeline and at runtime to ensure only compliant, approved software is deployed to production.

Insider Threat

Mon, 01 Jan 0001 00:00:00 +0000

Insider Threat #

Risk ID: SDLC-RISK-0002

Authorized personnel (developers, contractors, administrators, or other trusted users) with legitimate access to source code repositories, development environments, production systems, or sensitive data may intentionally or unintentionally compromise the confidentiality, integrity, or availability of software assets.

Mapped Controls

Artifact Binary Provenance

Description #

Insider Threat includes risks of malicious code injection, unauthorized data exfiltration, credential misuse, sabotage of build/deployment pipelines, or negligent security practices that expose systems to exploitation. Additionally, insider threat encompasses scenarios where external attackers have compromised the credentials of legitimate users, enabling them to conduct attacks while masquerading as trusted personnel with valid access. The trusted position and technical knowledge of insiders—or attackers leveraging insider credentials—makes detection difficult and potential impact significant.

Quality Assurance

Mon, 01 Jan 0001 00:00:00 +0000

Functionality of software is assured through systematic testing prior to production deployment.

Controlled Build Environment

Mon, 01 Jan 0001 00:00:00 +0000

Build environments are defined as code, ephemeral, and auditable, providing resilience against supply chain attacks.

Controls Engineering

Mon, 01 Jan 0001 00:00:00 +0000

Controls Engineering #

Controls Engineering is the application of modern software engineering practices to the domain of governance, risk, and compliance. Think of it as asking: “What would happen if we applied software engineering to compliance and risk management?”

This is analogous to how Google created Site Reliability Engineering (SRE) by asking what would happen if software engineers did operations work. Controls Engineering asks the equivalent question for governance.

Secrets Management

Mon, 01 Jan 0001 00:00:00 +0000

Build and runtime secrets are stored securely in dedicated secrets management systems, with documented ownership, rotation schedules, and access controls.

Training

Mon, 01 Jan 0001 00:00:00 +0000

All team members complete annual security awareness training covering the OWASP Top 10, ensuring a security-conscious development workforce.

Unauthorised Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Unauthorised Deployment #

Risk ID: SDLC-RISK-0003

Software is deployed to production without passing required quality gates, security scans, or approval checks.

Mapped Controls

SDLC-CTRL-0010:

Deployment Approvals

SDLC-CTRL-0002:

SDLC-CTRL-0013:

Deployment Controls

Description #

Unauthorised Deployment occurs when software artefacts reach production environments without completing the required quality gates, security validations, or approval workflows. This can happen through misconfigured CI/CD pipelines, direct manual deployments that bypass automated controls, or exploitation of overly permissive deployment credentials. The risk is compounded in environments where deployment tooling lacks sufficient access controls or where emergency “break-glass” procedures are poorly governed and frequently abused.

Vulnerability Scanning — SAST

Mon, 01 Jan 0001 00:00:00 +0000

Static Application Security Testing (SAST) analyses application source code to identify security vulnerabilities, coding flaws, and insecure patterns before software is deployed.

Vulnerability Scanning — SCA

Mon, 01 Jan 0001 00:00:00 +0000

Software Composition Analysis (SCA) identifies known vulnerabilities (CVEs) in third-party dependencies, libraries, and other software components before they are deployed to production.

Vulnerability Scanning — Containers

Mon, 01 Jan 0001 00:00:00 +0000

Container images are scanned for operating system and application-level vulnerabilities as part of the build and deployment process.

Credential and Secret Exposure

Mon, 01 Jan 0001 00:00:00 +0000

Credential and Secret Exposure #

Risk ID: SDLC-RISK-0004

Leaked or poorly managed secrets enable unauthorised access to production systems, customer data, or CI/CD pipelines.

Mapped Controls

Vulnerability Scanning — SAST

Description #

Credential and Secret Exposure occurs when sensitive authentication material—such as API keys, database passwords, service account tokens, encryption keys, or certificates—is inadvertently or deliberately exposed in locations where it can be accessed by unauthorised parties. This commonly happens through secrets committed to version control repositories, hardcoded credentials in application code, secrets leaked in CI/CD logs and artifacts, or credentials stored in insufficiently protected configuration management systems. Once exposed, credentials can be harvested by attackers and used to gain unauthorised access to production systems, customer data, and internal infrastructure.

Dependency Management

Mon, 01 Jan 0001 00:00:00 +0000

Every dependency is defined securely, managed, and auditable as part of the software development lifecycle.

Deployment Approvals

Mon, 01 Jan 0001 00:00:00 +0000

All deployments to production are approved by someone other than the person making the change, meeting segregation of duties requirements.

Penetration Testing

Mon, 01 Jan 0001 00:00:00 +0000

Penetration testing is conducted periodically to identify exploitable vulnerabilities in applications and infrastructure that automated scanning may not detect.

System Access Controls

Mon, 01 Jan 0001 00:00:00 +0000

All access to runtime environments requires authentication via SSO and generates full audit trails for review.

Infrastructure and Configuration as Code

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure and configurations are defined as code, stored in version control, and applied through automation to ensure auditability and reproducibility.

Runtime Workload Monitoring

Mon, 01 Jan 0001 00:00:00 +0000

Production workloads are continuously monitored to detect and alert on any non-compliant or unauthorised changes in real time.

Service Ownership

Mon, 01 Jan 0001 00:00:00 +0000

All services running in production environments have registered ownership, ensuring clear accountability for maintenance, support, and security.

Vulnerable Software in Production

Mon, 01 Jan 0001 00:00:00 +0000

Vulnerable Software in Production #

Risk ID: SDLC-RISK-0005

Known vulnerabilities in code or dependencies are exploited in the production environment.

Mapped Controls

SDLC-CTRL-0020:

SDLC-CTRL-0021:

Vulnerability Scanning — SCA

SDLC-CTRL-0022:

Vulnerability Scanning — Containers

SDLC-CTRL-0004:

Dependency Management

Artifact Binary Provenance

Description #

Vulnerable Software in Production occurs when applications or their dependencies containing known security vulnerabilities are deployed to and remain running in production environments. This risk arises from inadequate vulnerability scanning during the build and release process, failure to keep dependencies up to date, delayed patching of known CVEs, or insufficient visibility into the software composition of running workloads. Attackers actively scan for known vulnerabilities and can exploit them rapidly once public disclosures are made, making timely detection and remediation critical.

Feature Flags

Mon, 01 Jan 0001 00:00:00 +0000

Feature flags provide controlled, gradual exposure of new functionality in production, enabling safe releases and rapid rollback without redeployment.

Audit and Compliance Failure

Mon, 01 Jan 0001 00:00:00 +0000

Audit and Compliance Failure #

Risk ID: SDLC-RISK-0006

Inability to provide evidence of controls to regulators, auditors, or enterprise customers, resulting in reputational or commercial damage.

Mapped Controls

SDLC-CTRL-0002:

Description #

Audit and Compliance Failure occurs when an organisation cannot produce sufficient evidence that its software development and operational controls are functioning as intended. This risk is not about the absence of controls themselves, but about the inability to demonstrate their existence and effectiveness to regulators, auditors, or enterprise customers. It arises from gaps in record-keeping, inconsistent control enforcement, lack of traceability between changes and approvals, or reliance on manual processes that leave insufficient audit trails. In regulated industries, the burden of proof lies with the organisation—controls that cannot be evidenced are treated as controls that do not exist.

Drift Detection

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure and configuration are continuously monitored for drift from the approved baseline defined as code, detecting unauthorised or unintended changes.

Secrets Scanning

Mon, 01 Jan 0001 00:00:00 +0000

Source code, built binaries, and configuration files are scanned for secrets at multiple stages of the development lifecycle to prevent credential exposure.

Unauthorised System Access

Mon, 01 Jan 0001 00:00:00 +0000

Unauthorised System Access #

Risk ID: SDLC-RISK-0007

Production environments are accessed by personnel without appropriate authorisation or without full audit trails.

Mapped Controls

SDLC-CTRL-0015:

Infrastructure and Configuration as Code

SDLC-CTRL-0014:

Secrets Management

Description #

Unauthorised System Access occurs when individuals gain access to production environments, infrastructure, or sensitive systems without appropriate authorisation or without their access being fully recorded and auditable. This includes scenarios where access controls are too broad, where former employees or contractors retain active credentials, where shared accounts obscure individual accountability, or where privileged access is granted without time-bound restrictions or proper justification. The risk extends to both external attackers who exploit weak access controls and internal personnel whose access exceeds their legitimate operational needs.

Vulnerability Scanning — Runtime Containers

Mon, 01 Jan 0001 00:00:00 +0000

Container images already running in production are periodically re-scanned for vulnerabilities, so that CVEs disclosed after deployment are detected against live workloads.

Configuration Drift

Mon, 01 Jan 0001 00:00:00 +0000

Configuration Drift #

Risk ID: SDLC-RISK-0008

Infrastructure or application configuration diverges from its known, approved state, causing undetected changes in security posture or behaviour.

Mapped Controls

SDLC-CTRL-0005:

Description #

Configuration Drift occurs when the actual state of infrastructure, application configuration, or deployment environments diverges from the known, approved, and version-controlled state. This divergence can result from manual changes applied directly to production systems, emergency fixes that are never reconciled with the source of truth, inconsistent configuration management practices, or failures in infrastructure-as-code pipelines. Configuration drift is particularly insidious because changes accumulate silently over time, creating a growing gap between what the organisation believes is running and what is actually deployed. This gap undermines security controls, complicates incident response, and erodes confidence in the environment’s integrity.

Environment Breach

Mon, 01 Jan 0001 00:00:00 +0000

Environment Breach #

Risk ID: SDLC-RISK-0009

External attacker running workloads in our system.

Mapped Controls

SDLC-CTRL-0019:

Penetration Testing

SDLC-CTRL-0015: