Secure Lifecycle

Question 1

SDLC phases

Answer 1

• Requirement Analysis
• Design
• Implementation
• Testing
• Evolution
• Repeat

Question 2

SDLC: Requirement analysis

Answer 2

• Define scope of project and security/privacy boundaries
• Define security specification, identify assets, assess environment, and specify use/abuse cases
  -> Threat modeling
  -> Security requirements
  -> Third party dependencies

Question 3

SDLC: Design

Answer 3

• The classic design phase focuses on functionality requirements
  -> here we make security concerns an integral part of the analysis
• Continuously update threat model as requirements change
• Security design review
• Design documentation

Question 4

SDLC: Implementation

Answer 4

• During implementation, the design may be slightly refined and the security documents must be updated accordingly along with continuous reviews and analysis
  -> Code reviews
  -> Static analysis
  -> Vulnerability scanning
  -> Unit tests
  -> Accountability (version control)
  -> Coding standards
  -> Continuous integration

Question 5

SDLC: Testing

Answer 5

• Completed components are rigorously tested before they are finally integrated into the prototype
  -> Fuzzing
  -> Dynamic analysis
  -> Third party penetration testing

Question 6

SDLC: Release

Answer 6

• Before release of the final prototype, verify the base assumptions from the initial requirement analysis and design
  -> Security review
  -> Privacy review
  -> Review all licensing agreements

Question 7

SDLC: Maintenance

Answer 7

• After shipping software, continuously maintain security properties
  -> Track third-party software
  -> Provide vulnerability disclosure contacts
  -> Regression testing
  -> Deploy updates securely