At which of the following phases of a software development life cycle are security and access
controls normally designed?

A.
Coding

B.
Product design

C.
Software plans and requirements

D.
Detailed design

Explanation:
Security controls and access controls are normally designed in the “Detailed” phase
of design. In this phase you have the design of many of the security features of your development
like authentication, confidentiality functionality, non repudiation capabilities. In this phase you can
also define what is going to be the access control method for the software, we can make it
discretionary (less restrictive), mandatory (more restrictive), role based and others.