How to Maintain Security During Development

For most people involved in the software development life cycle, the sheer amount of work and responsibilities associated with developing the software itself is enough to worry about. However, the recent increase in cybersecurity attacks and data breaches means that modern project managers must pay just as much attention to information security as they do to software design. The number of data breaches has increased by 600 percent since 2005 and is on pace to break every record in 2019. That’s why the best managers focus so heavily on information security throughout every step of the software development cycle, relying on in-house security experts and software outsourcing partners alike to shore up their weaknesses.

The Software Development Life Cycle and Software Security

The software development life cycle is a set of steps necessary to bring a piece of software from its initial conception and planning stage to its release to the general market. This process includes the planning and design, development, testing, and implementation phases and can be seen in some form in every software development methodology in use today, including the highly regimented Waterfall method and the ultra-flexible Agile approach. Managers should understand the cycle itself in detail and should have a working knowledge of the four most important software development methodologies in use today: Agile, Lean, Waterfall, and V-shaped.

In addition, the growing risk posed by hackers and nefarious state actors means that project managers must integrate software security into every single step of the process. A secure software development cycle can be ensured from the initial planning stages all the way to the post-implementation phases of the process. The most popular methodology in use today is Microsoft’s Trustworthy Computing Security Development Lifecycle, which is designed for software that must withstand sophisticated security attacks and protect confidential user data.

Popular Security Models

Early work on software security was pioneered by the United States government, who was concerned with protecting the public and private sector software from being penetrated by foreign governments and hackers with ill will. The early “Trusted Software Development Methodology,” created by the Strategic Defense Initiative, is one of the earliest examples of a security-focused software methodology. This section will explore the three most commonly used security models in-use today.

Trusted Software Methodology

Originally developed by the United States government’s Strategic Defense Initiative, the Trusted Software Development Methodology (now know as the Trusted Software Methodology) uses different levels of trust to determine which level of security should be used. Most frequently used to transmit sensitive data, the updated Trusted Capability Maturity Model is used by the U.S. federal government and by banks across the world. It requires a substantially longer testing and evaluation phase in order to ensure success.

Systems Security Engineering Capability Maturity Model

The Systems Security Engineering Capability Maturity Model (SSE-CCM) is a process methodology that helps organizations assess their current information security efforts and offer improvements on how to secure sensitive data. By using a standard set of security engineering principles, this approach helps companies quickly measure their processes against the industry standard. This framework provides much-needed specifics for managers and the 22 process areas make it easy for developers to integrate security into every aspect of the software development cycle.

Microsoft’s Trustworthy Computing Security Development Lifecycle

Microsoft’s software security framework is widely considered to be the gold standard in the industry and has been adopted by a variety of companies across a range of industries. This process integrates security concerns into every step of the software development cycle and clearly defines security feature requirements for engineering teams without experience with the security side of the development process. Tools like threat modeling, static analysis code-review, and security-focused testing help ensure that software is ready to withstand the most advanced hacking threats.

How to Integrate Information Security into Software Development

Requirements Analysis and Design Stages

The requirements analysis and design stages of the software development cycle are vital to maintaining information security. This phase focuses on determining the requirements of the software: what problem will this software solve, what resources are needed to build it, and what development methodology will be followed? Several common vulnerabilities can be identified early in the development cycle. Companies can work with internal security experts or find these specialists from a software outsourcing service during this requirements analysis phase, ensuring that information security concerns are incorporated into the feasibility study.

Information security should also be addressed during each portion of the design stage. For example, security procedures should be included in the database requirements, a system flow diagram, and the overall security design. Threat modeling, which involves predicting where an attack will occur, can also help teams visualize the threat and ensure that protections are integrated early on. While the development of the software itself might seem paramount during this time period, keep in mind that a few hours spent deliberately integrating security into the software at this point in the process will pay off later in the development cycle.

Development

The development phase of the software cycle makes up the bulk of the project and includes writing code and building the software itself. Important implementation tools like static and dynamic application security testing help companies identify problems with their code and potential security vulnerabilities. These tools can alert software engineers to problems in real-time or can be programmed to run nightly — ensuring that the development staff has a list of all code errors when they arrive at work the next day.

One of the most effective ways to identify vulnerabilities in code and to prevent these problems from occurring again is to train the development staff to not just identify coding mistakes but to help them understand exactly how security weaknesses can happen. For example, once a development team understands that a SQL injection is able to gain access to protected data through database queries, they can prevent their website from executing SQL commands and ensure that this type of vulnerability is proactively protected against in the future.

Testing

Long seen as the only bulwark against faulty code, most experienced project managers now understand that testing is just one of several defenses against hackers. Every piece of software must go through an extensive testing phase before it is released to market. While many managers think of this step as being primarily focused on software performance and clearing out remaining bugs, security testing is just as important during this stage of the software development cycle and should occur hand-in-hand with general system testing.

One of the most effective ways to ensure security during the software testing phase is to bring an experienced software developer engineer in test on board to assist with the process. These highly-specialized programmers are much more than simple manual testers--they are capable of writing automated programs that will seek out security vulnerabilities and alert the development team to their existence. Project managers should bring in internal security experts or one provided by a software outsourcing company to integrate the security and system testing phases together.

Post-Implementation Security

Now that the software has been developed and approved by internal stakeholders, it is ready to be released to customers; however, security monitoring and integration must continue. The post-implementation phase of the software development cycle involves soliciting user feedback to ensure that the software is operating correctly and that consumers have not identified additional flaws. The wide network of talented security researchers who perform software security analyses as a public service means that useful information about security flaws are likely to arise at this time.

It is important that security specialists are involved in collecting and reviewing user feedback to confirm that no major security vulnerabilities are present. Furthermore, it is important to ensure that the in-house team is set up for future success. An incident response plan should be outlined to help developers address new vulnerabilities as they become known. This plan ensures process continuity regardless of whether a company is using IT outsourcing or expecting personnel changes in the future.