Explain the concept of secure software development lifecycle (SDLC) and DevSecOps.

• A. DevSecOps is about faster development without security.
• B. Security is applied after deployment.
• C. Integrate security into each SDLC phase; automate security testing and shift-left security practices.
• D. SDLC excludes security requirements.

Answer: (C)

Secure software development means weaving security into every step of the software lifecycle and making it a shared responsibility across development, security, and operations. In practice, that means identifying and prioritizing security requirements from the start, designing with secure controls, and coding with security in mind, then continuously testing and validating security as code is built, integrated, and deployed.

DevSecOps extends this idea by embedding security into the delivery pipeline itself. Security checks are automated and run as part of the CI/CD process—things like static and dynamic analysis, dependency and configuration scanning, and infrastructure-as-code checks become normal, repeatable parts of building and releasing software. The goal is to shift security left, discovering and fixing vulnerabilities earlier when they’re cheaper and easier to remediate, rather than waiting until after deployment.

This approach also promotes a culture of collaboration where security is not a gate the team must pass at the end, but a constant consideration that guides design, coding practices, testing, and operations. By automating security testing and providing fast feedback, teams can release more confidently and maintain a higher security posture over time.