DEV Community

Cover image for Threat Modeling vs SDL vs Code Reviews vs SAST vs DAST vs SCA
Shiva Charan
Shiva Charan

Posted on

Threat Modeling vs SDL vs Code Reviews vs SAST vs DAST vs SCA

(Threat Modeling vs SDL vs Code Reviews vs SAST vs DAST vs SCA)

🧠 1️⃣ Threat Modeling 

Think before you build
Enter fullscreen mode Exit fullscreen mode

📌 What it is

Threat Modeling is a design-time activity where you identify what can go wrong, how attackers might exploit it, and what to protect.

🔍 Focus

  • Attack surfaces
  • Entry points
  • Trust boundaries
  • Abuse cases

🕒 When

🟢 Before coding starts
🟢 During architecture & design

🛠 Common methods

  • STRIDE
  • Attack trees
  • Data Flow Diagrams (DFD)

🎯 Output

  • Identified threats
  • Mitigation strategies
  • Security requirements

✔ Prevents bad designs
✖ Does NOT scan code

🔄 2️⃣ Security Development Lifecycle (SDL) 

Security baked into every phase
Enter fullscreen mode Exit fullscreen mode

📌 What it is

SDL is a process framework that integrates security into every phase of software development.

🔍 Focus

  • People
  • Process
  • Technology

🕒 When

🟢 End-to-end lifecycle

🧩 Typical phases

  1. Requirements
  2. Design
  3. Implementation
  4. Verification
  5. Release
  6. Maintenance

🎯 Output

  • Secure-by-design software
  • Repeatable security practices

✔ Holistic security
⚠ Not a tool

👀 3️⃣ Code Reviews 

Humans review logic, not just syntax
Enter fullscreen mode Exit fullscreen mode

📌 What it is

Manual or peer review of source code to catch logic flaws, security mistakes, and bad practices.

🔍 Focus

  • Authentication logic
  • Authorization checks
  • Error handling
  • Secrets handling

🕒 When

🟢 During pull requests
🟢 Before merge

🎯 Output

  • Cleaner code
  • Early bug detection
  • Knowledge sharing

✔ Finds logic issues
✖ Slow and human-dependent

🤖 4️⃣ Static Application Security Testing (SAST) 

Scan code without running it
Enter fullscreen mode Exit fullscreen mode

📌 What it is

Automated analysis of source code or binaries to find vulnerabilities.

🔍 Focus

  • SQL Injection
  • XSS
  • Hardcoded secrets
  • Insecure APIs

🕒 When

🟢 During build
🟢 CI pipeline

🎯 Output

  • Vulnerability reports
  • Line-level findings

✔ Early detection
⚠ False positives

🌐 5️⃣ Dynamic Application Security Testing (DAST) 

Hack the running app
Enter fullscreen mode Exit fullscreen mode

📌 What it is

Automated testing of a running application from the outside.

🔍 Focus

  • Runtime behavior
  • Misconfigurations
  • Auth/session issues

🕒 When

🟢 After deployment
🟢 Test / staging / prod

🎯 Output

  • Exploit-based findings
  • Real attack scenarios

✔ Real-world attacks
✖ No code visibility

📦 6️⃣ Software Composition Analysis (SCA) 

Your code is not the only risk
Enter fullscreen mode Exit fullscreen mode

📌 What it is

Scans third-party libraries & dependencies for known vulnerabilities.

🔍 Focus

  • Open-source components
  • License compliance
  • CVEs

🕒 When

🟢 During build
🟢 Continuously

🎯 Output

  • Vulnerable dependency list
  • Upgrade recommendations

✔ Protects supply chain
✖ Doesn’t scan your code logic

🧩 How They Fit Together (Big Picture)

Practice Design Code Build Runtime Dependencies
Threat Modeling ✅ ❌ ❌ ❌ ❌
SDL ✅ ✅ ✅ ✅ ✅
Code Review ❌ ✅ ❌ ❌ ❌
SAST ❌ ✅ ✅ ❌ ❌
DAST ❌ ❌ ❌ ✅ ❌
SCA ❌ ❌ ✅ ❌ ✅

🏁 Final Takeaway

👉 No single practice is enough

✔ Threat Modeling prevents bad designs
✔ SDL ensures security is continuous
✔ Code Reviews catch logic flaws
✔ SAST finds code-level bugs early
✔ DAST finds runtime vulnerabilities
✔ SCA secures your supply chain

💥 Real DevSecOps uses ALL of them together

Top comments (0)