Subscribe
Implementing security measures should be a top priority to ensure the success of your software development life cycle (SDLC).
First things first, it’s vital to maintain engagement with stakeholders throughout the development process. Understanding and managing stakeholder expectations guarantees that the final product’s success, in the stakeholder’s eyes, complements the criticality of designing and building security into the software.
Full engagement helps mitigate potential surprises in the end.
Another element that runs throughout the SDLC is the need to enforce requirements traceability. This ensures that all requirements (especially security requirements) are traced through all phases of the SDLC to prevent gaps. This also serves as a guide to generate clear test objectives and cases for all requirements. Traceability eases customer acceptance of the final product, providing confidence that all requirements are met and tested.
While these elements are relevant to all phases of the SDLC, here are 10 phase-specific ways to infuse even more security into your software development life cycle:
1. Assess the landscape
SDLC phase: Requirements gathering
Begin the cycle with a strong understanding of what the customer actually wants. Here’s how to make that happen:
- Establish the scope and boundaries
- Identify stakeholders
- Identify process gaps
- Institute tailored security-centric processes scaled to the organization and project scope
2. Incorporate an industry-standard security model
SDLC phase: Requirements gathering
Secure the software you’re building from the beginning. This is the most cost-effective way to minimize the ‘test-patch-retest’ cycle that often negatively affects budget and scheduling goals near the end of the life cycle.
Integrate a trusted maturity model into your SDLC to infuse best practices and solid security design principles into the organization. The Building Security In Maturity Model (BSIMM) acts as a measuring stick that pinpoints strengths and weaknesses in your current security initiative. A BSIMM assessment can help your firm create data-driven goals.
3. Educate personnel on software security
SDLC phase: Requirements gathering
Ensure that all personnel involved in the project are knowledgeable and up-to-date with software security standards to reduce insecure design and development practices. Investing in training your staff is scalable, and aligns with the overall organization and the scope of each software development project at hand. The benefits resulting in a well-trained staff span all software development projects and can be an enterprise-wide asset.
4. Assign responsibility of software security
SDLC phase: Requirements gathering
To ensure that software security is incorporated into the SDLC, formally assign responsibility for it. Depending on the size of your organization, creating a software security group (SSG) is an effective way to educate, assess, and enforce established security measures across the organization. This is key to maintaining change and risk management as your organization scales up, without degrading or ignoring security all together.
The SSG should act as the subject matter experts in software security, facilitating and conducting third-party security assessments during critical stages within the SDLC.
5. Perform security-focused requirements gathering
SDLC phase: Requirements gathering
Tailor your organization’s approach to generating security requirements as a part of the initial phase. This approach will aid in embedding a solid security mindset throughout the SDLC. Generate abuse and misuse cases and perform an initial risk analysis during the requirements gathering phase to promote security activities in additional phases within the SDLC. This will also drive focus on testability when generating requirements.
6. Establish and institute a comprehensive risk management process
SDLC phase: Requirements gathering
It is critical to your SDLC’s success to identify major risks and execute a mitigation plan. These are also key aspects to:
- Ensure proper security design
- Ensure an effective guide in SDLC execution in terms of:
- Controlling scope-creep
- Staying within budget and schedule goals
- Engaging with stakeholders
7. Perform architecture reviews and threat modeling
SDLC phase: Design
It is far more cost-effective to identify and remediate design flaws early in the design process than to patch flawed design implementations once the software is deployed. Along with threat modeling, architecture risk analysis is a critical tool to detect design flaws. Flaws are identified by:
- Analyzing fundamental design principles
- Assessing the attack surface
- Enumerating various threat agents
- Identifying weaknesses and gaps in security controls
8. Carry out code reviews during implementation
SDLC phase: Implementation
Along with secure coding standards and static code analyses, perform a secure code review as a condition to passing a release gate. This drastically reduces the number of bugs escaping into the finished product. An effective defect containment and management system also aids in prioritization and tracking defects to resolution.
9. Execute test plans and perform penetration tests
SDLC phase: Verification
Execute the test plans during the verification phase. This will verify whether the product performs as expected in runtime scenarios. Penetration tests assess how the product handles various abuse cases, including:
- Malformed input handling
- Business logic flaws
- Authentication/authorization bypass attempts
- Overall security posture
10. Deploy software product
SDLC phase: Deployment/maintenance
Generate a deployment plan. This is essential to a successful release to production once thorough QA and acceptance testing are complete. The plan should detail the environment in which the software will operate and the steps for configuration and launch.
Plans for software maintenance and a change management process should be in place at this stage to efficiently handle any bugs or enhancement requests that come out of production.
Rollback plans and disaster recovery requirements in this phase also help ensure continued customer confidence.
Bonus: Stand up an incident response group and plan
The threat landscape is ever changing. It’s only a matter of time before a vulnerability is discovered. An incident response plan and group prepared to execute that plan is critical to ensure the security of the deployed product and enterprise. The group should be able to effectively and quickly respond to incidents in order to contain or minimize any potential damage. This is also a key source of security best practices that should flow back into the SDLC for future iterations and new products.
Continue Reading
SANS report: Securing the shifting landscape of application development
