Increasingly you hear about the need to integrate security into the software development life cycle (SDLC). A few techniques, including threat modeling, logging and penetration testing, address different parts of the SDLC, but we still lack a standard process for addressing the entire life cycle.
Yes, some companies have developed their own processes:
For the most part, however, companies lack guidance or even information from which they can learn or use as a guideline. In time, the increasing need for a standard for secure design methodology will be addressed by the proper standards authority. Until then, a company can build a custom process based on the following guidelines.
Functional design
Technical design
Coding/construction
Integration & QA testing
Production deployment
As you can see, there are a lot of steps that can be taken to integrate security at different stages in the SDLC. The more steps we take to integrate security, the more difficult we make it for attackers to break into our application. This by no means is a complete process, but it can act as a guideline t
To continue reading for free, register below or login
To read more you must become a member of SearchSoftwareQuality.com
o companies that are still searching for answers on how to build a secure design methodology according to their needs. After all, every step -- however small -- is a step forward in securing your application.
Some other links to check out to find more details on some of the individual topics mentioned here:
Data classification
* http://www.yourwindow.to/information-security/gl_dataclassification.htm
Misuse case
*Threat modeling enhanced with misuse cases
*
Initial Industrial Experience of Misuse Cases in Trade-Off Analysis
* Capturing Security Requirements through Misuse Cases(PDF)
Security patterns
*Core Security Patterns: Best Practices and Strategies for J2EE, Web Services, and Identity Management -- Chapter 8
* Security Patterns for J2EE Applications, Web Services, Identity Management, and Service Provisioning
Threat modeling
* Threat Modeling (Microsoft Professional) (Book)
-------------------------------
About the author: Anurag Agarwal, CISSP, works for a leading software solutions provider where he addresses different aspects of application security. You may e-mail him at anurag.agarwal@yahoo.com.
