Belajar Security Architect - Secure SDLC & DevSecOps Architecture

#Pendahuluan

Setelah di episode 10 kita mempelajari compliance & regulatory architecture, pada episode ini kita dalami secure SDLC & DevSecOps architecture — bagaimana mengintegrasikan security ke dalam development lifecycle. Security architect harus mendesain bagaimana security dibangun ke dalam proses development, bukan sekadar menambahkan security testing di akhir.

Mengapa secure SDLC penting? Karena vulnerability yang ditemukan di design phase 100x lebih murah untuk diperbaiki dibandingkan yang ditemukan di production. Security harus dimulai dari planning, bukan dari testing.

#Security in SDLC

#SDLC Phases & Security Integration

100%

Phase	Security Activity
Requirements	Security requirements, compliance needs
Design	Threat modeling, security architecture review
Implementation	Secure coding, SAST, SCA
Testing	DAST, penetration testing
Deployment	Configuration review, hardening
Maintenance	Vulnerability monitoring, patching

#CI/CD Security Pipeline

#Pipeline Stages

100%

#Security Gates

Gate	Tool	Pass Criteria
SCA	Snyk, Dependabot	No critical/high vulns
SAST	SonarQube, Semgrep	No critical issues
DAST	OWASP ZAP	No high risk findings
Container	Trivy, Grype	No critical CVEs
IaC	Checkov, tfsec	No misconfigurations

Warning

Security gates harus balancible — terlalu ketat menghambat development, terlalu longgar melewatkan vulnerability. Mulai dengan critical-only, lalu ketatkan secara bertahap.

#Architecture Review

#Review Process

100%

#Architecture Review Checklist

Area	Questions
Authentication	How are users authenticated?
Authorization	How is access controlled?
Data protection	How is data encrypted?
Network	How is traffic controlled?
Logging	What is logged?
Incident response	How are incidents handled?

Tip

Architecture review harus dilakukan di awal project, bukan menjelang deployment. Biaya perubahan di design phase jauh lebih rendah daripada di production.

#DevSecOps Design Patterns

#Pattern 1: Security Champions

Role	Responsibility
Security Champion	Embedded in dev team
Responsibility	Advocate security, run reviews
Reporting	Dual reporting: dev + security

#Pattern 2: Automated Security

Area	Automation
Dependency updates	Dependabot/Renovate
Secret scanning	GitLeaks, truffleHog
IaC validation	Pre-commit hooks
Container scanning	CI/CD integration

#Pattern 3: Shift Left

Traditional	Shift Left
Security testing at end	Security from requirements
Security team owns all	Dev teams own their security
Periodic assessment	Continuous assessment

#Penutup

Inti yang harus dibawa pulang:

Security in SDLC: integrated from requirements, not bolted on at end.
CI/CD security: SAST → SCA → DAST → Container → IaC scan.
Architecture review: early and mandatory.
DevSecOps: security champions + automation + shift left.

Di episode 12 selanjutnya kita akan membahas security architecture review process — lifecycle review, ADRs, dan governance arsitektur.