D487 Secure Software Design is a course in Western Governors University's Master of Science in Cybersecurity and Information Assurance (MSCSIA). It asks how security can be designed in from the start of a software project instead of bolted on at the end.
WGU describes the course as covering the elements needed to acquire and develop secure software across the software development life cycle (SDLC), including people, technology, tools and processes.
Many students find it demanding because the answer is rarely a single tool. You are expected to show how requirements, design, coding, testing and deployment each carry their own security duties, and to justify those choices for a given scenario.
Course at a Glance
| Item | Details |
|---|---|
| University | Western Governors University (WGU) |
| Course code | D487 |
| Program | M.S. Cybersecurity and Information Assurance |
| Level | Graduate |
| Competency units | 3 (program guide, catalog version 202306) |
| Prerequisites | D481 Security Foundations and D482 Secure Network Design are listed as foundational for the remaining courses |
| Format | Competency-based and self-paced; the task instructions state the exact assessment |
What D487 Covers
WGU's program guide lists four competencies for the course. Together they trace a project from requirements to release:
| Competency (summarized) | In practice |
|---|---|
| Assess software requirements and risks so threats are addressed | Threat modeling, abuse cases and security requirements |
| Evaluate software security test plans and implementation strategies | Static and dynamic testing, code review and test coverage |
| Evaluate how effective testing and deployment are for security and privacy | Release gates, configuration, monitoring and privacy checks |
| Examine security principles, standards and methods within the SDLC | Secure design principles and recognized frameworks |
The description also stresses Defense in Depth across the whole life cycle and adapting security activities to Agile and DevSecOps.
Key Concepts Explained
Security Activities by SDLC Phase
A strong answer ties each activity to a phase and says what it prevents. Requirements work finds what must be protected. Design reviews catch structural flaws. Code review and analysis catch implementation bugs. Testing confirms controls work, and deployment checks protect the running system.
Example: A team builds a patient-booking web app. At requirements, they list personal data and the privacy rules that apply. At design, they model threats such as a stolen session token. At coding, they use parameterised queries to stop injection. At testing, they run dynamic scans and fix findings before release. After release, they monitor logs for repeated failed logins.
Defense in Depth
Defense in Depth means layering controls so that one failure does not expose everything. In software this includes input validation, authentication, least privilege, encryption and logging, each backing up the others.
Security in Agile and DevSecOps
Short sprints do not remove security tasks; they spread them out. Threat checks go into backlog grooming, automated scans into the build pipeline, and security acceptance criteria into each story.
Typical Assignments and How to Approach Them
WGU states the exact format in each task, so follow the instructions you are given. Work in this course typically looks like the following.
| Work type | What it tests | How to approach it |
|---|---|---|
| Scenario-based security plan | Linking SDLC phases to controls | Use one heading per phase and name the risk each control reduces |
| Test plan evaluation | Judging coverage and gaps | Compare planned tests with the identified threats |
| Standards and method review | Knowing recognized guidance | Name the standard, then apply it to the scenario |
Writing a Strong D487 Answer
Evaluators at a competency-based university look for each rubric point being clearly met, so structure matters as much as technical knowledge. Use headings that echo the task wording and keep each section to the point it answers.
A reliable pattern is: state the scenario and its main risks, walk through the SDLC phase by phase, then close with how you would verify the controls work. Under each phase, give the activity, the threat it addresses and the evidence that it was done.
| SDLC phase | Typical security activity | Evidence you can cite |
|---|---|---|
| Requirements | Security and privacy requirements, abuse cases | Requirement list linked to data types |
| Design | Threat modeling, secure design review | Threat list with mitigations |
| Implementation | Secure coding standards, peer and tool-based review | Review records and tool output |
| Testing | Static, dynamic and dependency testing | Test plan mapped to threats |
| Deployment and maintenance | Hardening, monitoring, patching | Release checklist and monitoring plan |
Finally, state any assumptions. If the scenario does not say how the team deploys, say which approach you are assuming and why it affects your recommendations.
Where Students Get Stuck
- Treating security as a final testing step. The course is about every phase, so show activity earlier in the life cycle.
- Generic lists of controls. Tie each control to a named threat in the scenario.
- Ignoring privacy. One competency covers privacy as well as security, so address both.
- Skipping the rubric wording. Evaluators work through the rubric line by line, so mirror its language in your headings.
Study Tips for D487
- Build a one-page grid of SDLC phases against security activities and keep it beside you while writing.
- Practice explaining one threat from requirement to test in three sentences.
- Review the foundational courses D481 and D482 first, since later courses assume them.
- Plan your own target dates; self-paced study can drift without them.
How We Help with D487
Send the task instructions, the rubric and any case material. A cybersecurity writer can explain the concepts, prepare a custom analysis of a comparable scenario, or review your own draft for gaps against the rubric.
GradeEssays is independent of Western Governors University. Our work is a study and reference aid: use it to learn the method, then write and submit your own assessment under WGU's academic integrity rules.
We do not take assessments or access course portals. Orders are written from scratch, include free revisions within the scope of your original request, and are refunded in full if late.
Make Sense of Your D487 Task
Share the scenario, rubric and your draft. We prepare a worked model or review your own work against the rubric.
Start My D487 HelpFree revisions · Full refund if late · Written from scratch for your order
Frequently Asked Questions
It is part of WGU's Master of Science in Cybersecurity and Information Assurance.
WGU's program guide lists D481 Security Foundations and D482 Secure Network Design as foundational prerequisites for the remaining courses, so plan to complete them first.
The program guide lists 3 competency units.
Yes. The course description says it introduces adapting security activities to modern practices such as Agile and DevSecOps.
It is layering several independent controls so that no single failure exposes the system. D487 applies the idea across the whole SDLC.
No. We provide tutoring, custom answers and feedback for study, and you must complete and submit your own work.