Which approach to software development security aligns with PCI DSS and industry best practice?

Which approach to software development security aligns with PCI DSS and industry best practice?

• A. Security is added after deployment.
• B. Security considerations are optional during development.
• C. Internal and external software are built using ad-hoc practices.
• D. Develop internal and external software securely, aligned with PCI DSS, industry standards, and incorporating information security throughout the SDLC.

Answer: (D)

The main approach being tested is that security should be built into the software development lifecycle, not added after the fact. PCI DSS requires secure software development practices and the integration of information security across all phases of development, from requirements and design through implementation, testing, deployment, and ongoing maintenance. Aligning with industry standards means adopting established security controls, such as secure coding guidelines, threat modeling, secure code reviews, and regular vulnerability management, so both internal and external software meet a consistent security baseline. This approach is best because it reduces the likelihood of security flaws making it into production, makes it easier and cheaper to remediate issues during development, and ensures ongoing alignment with PCI DSS requirements and best practices like threat modeling and secure SDLC processes. The other options place security on the periphery or treat it as optional or ad-hoc, which leaves critical gaps and fails to meet PCI DSS expectations for building secure software from the start.

The main approach being tested is that security should be built into the software development lifecycle, not added after the fact. PCI DSS requires secure software development practices and the integration of information security across all phases of development, from requirements and design through implementation, testing, deployment, and ongoing maintenance. Aligning with industry standards means adopting established security controls, such as secure coding guidelines, threat modeling, secure code reviews, and regular vulnerability management, so both internal and external software meet a consistent security baseline.

This approach is best because it reduces the likelihood of security flaws making it into production, makes it easier and cheaper to remediate issues during development, and ensures ongoing alignment with PCI DSS requirements and best practices like threat modeling and secure SDLC processes. The other options place security on the periphery or treat it as optional or ad-hoc, which leaves critical gaps and fails to meet PCI DSS expectations for building secure software from the start.