Ssdlc on Samarthya

SSDLC when exploits are cheap: a working concept

Tue, 27 Oct 2026 20:32:15 -0400

A fire inspection once a year works when fires are rare. When sparks are falling every day, you need smoke detectors in every room, a sprinkler that fixes the small ones by itself, and a person who decides what to do about the big ones. That is what a secure development life cycle has to become.

These are my notes for a question I keep coming back to: how do you keep shipping software when new vulnerabilities arrive faster than you can fix them, and attackers can use an LLM to turn a CVE description into a working exploit? There is no single standard answer. What follows is the concept I would build, with the evidence behind each choice and the parts where I am still unsure.

Security standards, plainly, part 4: CISA KEV and BOD 26-04

Sun, 25 Oct 2026 19:30:00 -0400

A hospital emergency room does not treat patients in the order they arrive, or by how loudly they shout. A triage nurse asks a few quick questions and sends the bleeding patient in first. CISA’s KEV catalog and directive BOD 26-04 are triage for vulnerabilities.

The first three parts of this series, SSDF, SAMM and SLSA, share one gap: none of them says how fast a vulnerability must be fixed. This part is about the clock.

Security standards, plainly, part 3: SLSA v1.2

Sat, 24 Oct 2026 19:30:00 -0400

A sealed medicine bottle tells you two things: who made it, and that nobody has opened it since. You do not need to test the pills yourself. SLSA gives software the same seal and the same label.

Part 1 (SSDF) listed what a secure process should do. Part 2 (SAMM) measured how well you do it. Both mostly look at the code. SLSA looks at the journey from code to the thing you ship, because attackers have learned that it is often easier to tamper with a build than to find a bug.

Security standards, plainly, part 2: OWASP SAMM v2.0

Fri, 23 Oct 2026 19:30:00 -0400

A fitness tracker does not make you fit. It tells you where you are today, lets you pick a goal you can reach, and shows whether you are moving towards it. OWASP SAMM is a fitness tracker for how an organisation builds secure software.

In part 1 NIST’s SSDF gave us a list of what a secure development process should include. It did not say how well you do each thing, or what to improve first. That is the gap SAMM fills.

Security standards, plainly, part 1: NIST SSDF (SP 800-218)

Thu, 22 Oct 2026 19:30:00 -0400

A building code does not tell you which bricks to buy. It tells you what a safe building must have: exits, wiring that will not catch fire, a way to stop the roof falling in. NIST’s Secure Software Development Framework is that code for software teams.

This series explains, for someone who does not live in security, the four names that keep coming up when people talk about building software safely: NIST SSDF, OWASP SAMM, SLSA and CISA’s KEV catalog with directive BOD 26-04. Each post answers three questions: what is it, what does it ask of a team, and what is it worth. I lean on all four in SSDLC when exploits are cheap.

MITRE ATT&CK, plainly: tactics, technique IDs and a cheat card for each tactic

Wed, 21 Oct 2026 19:30:00 -0400

A football coach studies match footage of the other team: how they open, how they press, how they score. MITRE ATT&CK is the match footage of real attackers, cut into named and numbered moves.

The OWASP Top 10 describes weaknesses in your software. ATT&CK describes what attackers do: how they get in, stay in, move around and take what they came for. You will see its IDs, such as T1190 or T1552.001, in threat reports, detection rules and, increasingly, in pipeline designs like the one in my SSDLC post. This post explains how to read them.

OWASP Top 10:2025, plainly: the ten risks and a cheat card for each

Tue, 20 Oct 2026 19:30:00 -0400

A pilot’s checklist does not list every way a plane can fail. It lists the few that keep happening, in the order that matters. The OWASP Top 10 is that checklist for web applications.

When a scanner says a finding is “A05” or a security review mentions “Top 10 coverage”, this is the list they mean. This post is a quick introduction: what the list is, what changed in 2025, why each category matters, and a cheat card for each one.