Module Overview

Architecture-led, secure-by-default delivery across the SDLC

Architecture-led approach to secure software development, UML-driven design, and assurance activities that embed security as a first-class requirement across the SDLC. The module combined design artefacts, secure coding implementation, and structured reflection to translate threat-modelling intent into working, testable code.

Module Learning Outcomes

The five outcomes assessed by this module

🧩

Secure UML Design

Design secure systems with UML based on object-oriented principles and clearly articulated architectural rationale.

🔐

Secure Coding

Use secure coding techniques such as password hashing, encryption, checksums, and RBAC, and justify design choices.

🧪

Testing & Automation

Integrate testing and automated quality gates to maintain code quality throughout the SDLC.

⚙️

Process Evaluation

Evaluate development approaches (e.g., agile and waterfall), ensuring security from inception to delivery.

🗣️

Communication

Communicate design and testing decisions to technical and non-technical audiences with clarity.

Key Artefacts

Summative submissions with feedback received

🧾

Development Team Project: Design Document

UNIT 3

Created a structured design using UML diagrams, highlighting security features (RBAC, password hashing in storage, file encryption, checksum, audit logging) guided by the CIA triad and least-privilege principles.

💻

Development Individual Project: Coding Output

UNIT 6

Developed a Python CLI implementing password hashing, encryption, checksums, timestamps, and RBAC, with unit tests and static/security analysis supported by README guidance and reports.

🪞

Individual Reflective Submission

UNIT 6

Structured reflection using Rolfe's model, connecting methodology comparisons, UML practice, and secure-SDLC integration to actionable improvements.

Action Plan

Concrete goals for the next 6–8 weeks

  1. Design hygiene. Add cover page/ToC, introduce an upfront "Security Features" list, refine use-case relationships, define acronyms, and alphabetise references — evidenced by an updated design document and refreshed UML exports. Week 2
  2. Modularity. Break the CLI into auth, crypto, storage, CLI, and models packages with updated imports and tests — confirmed via the repository tree and passing unit tests. Week 4
  3. Hardening & UX. Implement secure password input, governed account creation, file validation, retry limits, lockout, and richer audit logging — evidenced through new test cases, README notes, and sample audit logs. Week 5
  4. Evidence & docs. Record a short demo video, restructure the README for quick starts and task flows, and expand comments/docstrings — evidenced by the published video link, README diff, and improved linter scores. Week 3
  5. Automation. Introduce pre-commit hooks (Black, Flake8, Bandit, Pylint) and a CI pipeline, tracking trend data — evidenced by pipeline logs, a badge, and committed hook configuration. Week 3
  6. Reflection quality. Embed specific incidents, emotions, and corrected citations in the reflection, with the final document noting word count — evidenced by the revised submission. Week 2

Professional Skills Matrix

Snapshot of current competency and growth focus

Skill Summary
Secure design & UML Proficient level evidenced by clear use-case, class, and sequence diagrams with early security requirements; next step is refining relationships and standardising a pre-diagram "Security Features" list.
Secure coding (Python) Proficient implementation of bcrypt/Fernet, checksums, timestamps, and RBAC; plan to improve via modular packaging and stronger validation plus lockout controls.
Testing & automation Progressing from developing to proficient with unit tests and static/security analysis in place; focus is on formalising pre-commit and CI to enforce coverage and quality gates.
Code quality & maintainability Currently developing, with Flake8/Pylint highlighting docstring and complexity gaps; action is to refactor into modules, add documentation, and simplify functions.
Technical communication & documentation Proficient communication through the design document and README; improvement focuses on scan-readability and producing a short demo video.
Reflective practice At a developing stage, using Rolfe's model effectively; next step is adding personal challenges, decisions, emotions, and tighter citation placement.

References

ISO/IEC (2011) ISO/IEC 27034-1:2011 Information technology — Security techniques — Application security — Part 1: Overview and concepts. Geneva: International Organization for Standardization.

McGraw, G. (2006) Software Security: Building Security In. Boston: Addison-Wesley.

OWASP Foundation (2021) OWASP Application Security Verification Standard (ASVS) v4.0.3. Available at: https://owasp.org/www-project-application-security-verification-standard/

Saltzer, J.H. and Schroeder, M.D. (1975) 'The protection of information in computer systems', Proceedings of the IEEE, 63(9), pp. 1278–1308.

Howard, M. and Lipner, S. (2006) The Security Development Lifecycle. Redmond: Microsoft Press.