Integrating Security Into SDLC

Integrating Security Into SDLC

• Secure development enhances the software development life cycle (SDLC) by adapting existing SDLC activities, practices, and checkpoints.
• This results in more dependable, trustworthy, and resilient software systems.
• Software security relies on the absence of exploitable defects in source code and the binary executable.
• System security emphasizes safeguards and countermeasures like cryptography, access controls, and security boundaries.

SDLC Outline

• Introduction to SDLC
• System development life cycle (SDLC) explanation
• Secure development life cycle activities and practices

Introduction to Secure Software Development

• Focus on security enhancements within the SDLC.

Introduction

• Security enhancement within the SDLC involves adapting existing SDLC activities, practices, and checkpoints.
• The result is more dependable, trustworthy, and resilient software-based systems.

Software Security vs. System Security

• Software security relies on the absence of exploitable defects in source code and executables.
• System security relies on safeguards like cryptography, access controls, and security boundaries.

System Development Life Cycle (SDLC)

• A traditional methodology for systems development, maintenance, and replacement.

SDLC Methodologies, Techniques, Tools

• Methodologies are step-by-step approaches for developing information systems.
• Techniques are processes analysts follow to ensure well-thought-out complete and comprehensible work.
• Tools are computer programs to aid in using specific techniques (e.g., CASE tools).
• System development methodology is a standard process for organizations in analyzing, designing, implementing and maintaining information systems.

SDLC Phases

• Planning: Determining, analyzing, prioritizing and arranging total information system needs to translate into a plan for the IS department schedule.
• Analysis: Studying and structuring system requirements in two sub-phases - requirements determination and requirements studying and structuring.
• Design: Describing the recommended solution (logical and physical system specifications).
• Implementation: Coding, testing, installing, and supporting information systems within the organization.
• Maintenance: Systematically repairing and improving the system.

Products, Outputs, or Deliverables (by Phase)

• Planning - Priorities, architecture, detailed steps or work plans for projects, specifications, and assignment of resources.
• Analysis - System justification, business case, description of current systems, and recommendations for fixing systems.
• Design - Explanation of alternative systems, functional and technical specifications, plan for new technology.
• Implementation - Code, documentation, training procedures, and support capabilities.
• Maintenance - New versions or releases of software with updates
• Detailed specifications
• System elements

Traditional Waterfall SDLC

• One phase starts when the preceding phase is completed, with limited backtracking and looping.
• System requirements are "locked-in" after determination and can't change.
• User involvement is limited primarily during the requirements phase.
• Emphasis on milestone deadlines is sometimes detrimental to practices.

Different Approaches to Improving Development

• Prototyping, Computer-Aided Software Engineering (CASE) Tools, Joint Application Design (JAD), Rapid Application Development (RAD), Agile Methodologies, Extreme Programming

Secure Development Life Cycle Activities and Practices

• The table in the document lists phases, roles, activities, and additional/enhanced secure software activities.