AI › Module 7 › Lesson 1
Secure SDLC AI
Secure SDLC for AI literacy — threat model, data governance, model card, release gate — on `$AI_LAB` dev workflow stubs.
Visual · t32_secure_sdlc_ai
Secure SDLC AI = named lifecycle rows. $AI_LAB. Original Cyberlium.
Opening
AI features need SDLC gates like any software — name secure AI lifecycle rows on YOUR lab workflow before shipping toy apps.
Secure SDLC for AI literacy names: AI threat modeling category (STRIDE-for-LLM literacy stub), training data provenance, model card / system card category, pre-release eval gate, monitoring and incident category, and change control for prompts/models. Analyst drafts SDLC checklist on `$AI_LAB` toy app repo — maps five lifecycle gates with owner stub — without skipping eval for 'demo speed,' without training on scraped PII, without deploying lab jailbreak findings to prod without RoE. Cyberlium teaches defender lifecycle vocabulary on YOUR repos — NOT shortcut to weaponized releases. Refused: skip eval gate, prod deploy without ticket, malware-gen in CI. Lab row: secure AI SDLC checklist ten items applied to toy app.
1. Named lifecycle gates
Threat model, data provenance, model card, eval gate, monitoring — five literacy anchors.
Each gate maps to artifact in YOUR `$AI_LAB` toy repo.
Command guide
Try these commands — Named lifecycle gates
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SSDF (https://csrc.nist.gov/projects/ssdf); NIST AI RMF (https://www.nist.gov/itl/ai-risk-management-framework); OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Release discipline
No prompt/model change without eval rerun category — document on lab checklist.
Change control stub links Module 6 app security rows.
3. $AI_LAB boundary
YOUR toy repo or instructor stub only — not employer prod pipeline without RoE.
Refused: skip gates, scraped PII training, weaponized release artifacts.
4. What you ship: secure AI SDLC checklist
Ten lifecycle items applied to toy app + NEVER skip eval gate line.
5. What you record before the next lesson
Secure AI SDLC checklist path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Ship toy app to prod skipping eval because 'it's just AI demo.'
Right
Secure AI SDLC checklist from `$AI_LAB` toy repo. Next: Eval and Guards.
Mission: secure AI SDLC checklist
1) Name five SDLC gates. 2) Ten-item checklist on toy app. 3) Owner stub per gate UTC. 4) Write NEVER skip eval gate line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Model card — minimum literacy fields?”
Knowledge Check
APPLY: Secure SDLC AI uses:
Multiple choice
Knowledge Check
APPLY: True or False: Eval gate optional for AI demos.
True or False
Knowledge Check
APPLY: SDLC gates include:
Multiple choice