Posted by Kris Balarama on May 18, 2016
Implementing security measures should be a top priority to ensure the success of your software development life cycle (SDLC).
First things first, it’s vital to maintain engagement with stakeholders throughout the development process. Understanding and managing stakeholder expectations guarantees that the final product’s success, in the stakeholder’s eyes, complements the criticality of designing and building security into the software.
Full engagement helps mitigate potential surprises in the end.
Another element that runs throughout the SDLC is the need to enforce requirements traceability. This ensures that all requirements (especially security requirements) are traced through all phases of the SDLC to prevent gaps. This also serves as a guide to generate clear test objectives and cases for all requirements. Traceability eases customer acceptance of the final product, providing confidence that all requirements are met and tested.
While these elements are relevant to all phases of the SDLC, here are 10 phase-specific ways to infuse even more security into your software development life cycle:
Begin the cycle with a strong understanding of what the customer actually wants. Here’s how to make that happen:
Secure the software you’re building from the beginning. This is the most cost-effective way to minimize the ‘test-patch-retest’ cycle that often negatively affects budget and scheduling goals near the end of the life cycle.
Integrate a trusted maturity model into your SDLC to infuse best practices and solid security design principles into the organization. The Building Security In Maturity Model (BSIMM) acts as a measuring stick that pinpoints strengths and weaknesses in your current security initiative. A BSIMM assessment can help your firm create data-driven goals.
Ensure that all personnel involved in the project are knowledgeable and up-to-date with software security standards to reduce insecure design and development practices. Investing in training your staff is scalable, and aligns with the overall organization and the scope of each software development project at hand. The benefits resulting in a well-trained staff span all software development projects and can be an enterprise-wide asset.
To ensure that software security is incorporated into the SDLC, formally assign responsibility for it. Depending on the size of your organization, creating a software security group (SSG) is an effective way to educate, assess, and enforce established security measures across the organization. This is key to maintaining change and risk management as your organization scales up, without degrading or ignoring security all together.
The SSG should act as the subject matter experts in software security, facilitating and conducting third-party security assessments during critical stages within the SDLC.
Tailor your organization’s approach to generating security requirements as a part of the initial phase. This approach will aid in embedding a solid security mindset throughout the SDLC. Generate abuse and misuse cases and perform an initial risk analysis during the requirements gathering phase to promote security activities in additional phases within the SDLC. This will also drive focus on testability when generating requirements.
It is critical to your SDLC’s success to identify major risks and execute a mitigation plan. These are also key aspects to:
It is far more cost-effective to identify and remediate design flaws early in the design process than to patch flawed design implementations once the software is deployed. Along with threat modeling, architecture risk analysis is a critical tool to detect design flaws. Flaws are identified by:
Along with secure coding standards and static code analyses, perform a secure code review as a condition to passing a release gate. This drastically reduces the number of bugs escaping into the finished product. An effective defect containment and management system also aids in prioritization and tracking defects to resolution.
Execute the test plans during the verification phase. This will verify whether the product performs as expected in runtime scenarios. Penetration tests assess how the product handles various abuse cases, including:
Generate a deployment plan. This is essential to a successful release to production once thorough QA and acceptance testing are complete. The plan should detail the environment in which the software will operate and the steps for configuration and launch.
Plans for software maintenance and a change management process should be in place at this stage to efficiently handle any bugs or enhancement requests that come out of production.
Rollback plans and disaster recovery requirements in this phase also help ensure continued customer confidence.
The threat landscape is ever changing. It’s only a matter of time before a vulnerability is discovered. An incident response plan and group prepared to execute that plan is critical to ensure the security of the deployed product and enterprise. The group should be able to effectively and quickly respond to incidents in order to contain or minimize any potential damage. This is also a key source of security best practices that should flow back into the SDLC for future iterations and new products.
If your organization utilizes an Agile SDLC, learn how adding four key principles to your processes can help integrate critical security measures in a natural, effective way:
Get the latest AppSec news and trends sent directly to you.