Secure Software Development Life Cycle
1. Core Security Training Phase: Training to software development teams on application security, organizational and to make sure the team stays informed of the latest updates in security and privacy. Foundational concepts for building better software include secure design, threat modeling, secure coding, security testing, and best practices surrounding privacy.
Software development teams on application security, organizational policy and capabilities to make sure the team stays informed of the latest updates in security and privacy.
The Security Awareness Training for Software Developers includes the following modules:
- Secure Coding Best Practices based on the OWASP Top 10
- Defensive techniques, ideally presented as a framework (e.g. OWASP ESAPI)
- Web Service and Web 2.0 Threats
- Black-box Application Assessment Tools
- Best practices for secure code reviews
- Cryptography, Hashing and Obfuscation
- Input Validation Strategies
- Understanding Threats: Threat Modeling
2. Requirements Gathering Phase: These should be gathered by the same personnel, in fact. Since the idea of secure development is to start at the very beginning of the coding, it helps to have both the feature requirements and the security requirements side by side during planning.
- Security Requirements
- Risk Assessment
3. Planning and Design: Consider security and privacy in the initial design of new products and features and permits the integration of security in a way that minimizes disruptions to plans and schedules.
- Identify Design Requirements from security perspective
- Architecture & Design Reviews
- Threat Modeling
Consider security and privacy when designing new features of products and integrate security into applications with minimal disruption.
4. Implementation: Avoid coding issues that could lead to vulnerabilities and leverages state-of-the-art development tools to assist in building more secure code. Analyzing the source code prior to compile provides a scalable method of security code review and helps ensure that secure coding policies are being followed.
- Make certain SQL queries are parameterized correctly and that input is validated
- Ensure developers are performing proper validation to prevent Cross Site Scripting
- Coding Best Practices
- Perform Static Analysis
- Secure Data Storage
- Secure Access Control
Prevent coding errors from creating vulnerabilities as well as use sophisticated development tools to build more secure code.
5. Verification and Testing: Run-time verification of software applications to ensure that functionality works as designed. Apply appropriate verification to software applications and make sure they produce proper functionality as defined in the initial design.
- Vulnerability Assessment
- Fuzzing
Apply appropriate verification to software applications and make sure they produce proper functionality as defined in the initial design.
6. Deployment: Response plans and protocols to address new threats that emerges over time. Certifying software prior to a release helps ensure security and privacy requirements were met.
- Server Configuration Review
- Network Configuration Review
Nomination : https://x-i.me/prinom
Comments
Post a Comment