Secure Software Development Lifecycle Model for Cloud Native Enterprise Platforms

Abstract

Cloud-native enterprise platforms require rapid software delivery while maintaining security across source code, dependencies, container images, infrastructure configurations, identities, and runtime workloads. This study proposes the Secure Cloud-Native Software Development Lifecycle model, called SCN-SDLC, to integrate risk-based security controls throughout planning, architecture, implementation, build, deployment, and operation. The model applies change-exposure scoring, threat analysis, normalized security findings, software bill of materials verification, artifact provenance checks, least-privilege validation, policy-controlled deployment, and runtime assurance. It was evaluated across 100 controlled releases and compared with final-stage security review, scanner-only CI/CD, and standard DevSecOps. SCN-SDLC reduced unresolved high-risk findings reaching approval to 3.4 per 100 releases, compared with 18.6, 13.2, and 8.1 for the comparison approaches. It also shortened remediation time and improved provenance completeness and runtime policy coverage. These findings demonstrate that connected lifecycle evidence can strengthen enterprise cloud security without causing excessive delivery delays, supporting traceable security decisions across complex enterprise environments.