The key principles include least privilege, defense in depth, secure defaults, fail securely, and avoiding security by obscurity.

A threat modeling exercise typically involves identifying assets, assessing potential threats, evaluating vulnerabilities, implementing countermeasures, and continuously reviewing and updating the model.

Secure coding practices involve writing code that is resilient to attacks by following guidelines such as input validation, proper error handling, authentication and authorization checks, and adherence to coding standards.

Common tools and techniques include static code analysis, dynamic analysis, penetration testing, fuzz testing, and the use of automated tools like OWASP ZAP and Burp Suite.

Staying current involves following industry news, participating in security forums and conferences, taking continuous education courses, and subscribing to security bulletins from reputable organizations.

Security best practices in SDLC include integrating security requirements in the initial design phase, conducting regular code reviews, performing security testing at various stages, and ensuring regular updates and patch management.