Chapter 3 - Security in the Software Development Life Cycle

Question 1

The Software Development Life Cycle (SDLC)

Answer 1

The Software Development Life Cycle (SDLC) is a set of processes for creating and maintaining software. To enhance application security, the SDLC should include key security activities at various stages, including:

• Conceptual stage security
• Security application requirements and specifications
• Security in application design
• Threat risk modeling
• Security in application coding
• Security in testing

The NIST 800-64 standard, “Security Considerations in the System Development Life Cycle,” provides valuable guidance for security and development professionals, encouraging the integration of its recommendations into software development processes.

Question 2

Security in the Conceptual Stage

Answer 2

In the conceptual stage of application development, security considerations should be addressed. Key points to consider include:

Key points to address:

• Identification and protection of sensitive information.
• Management of information flows, both inbound and outbound.
• Determination of user and administrative access requirements.
• Control of third-party access and its management.
• Compliance with regulatory requirements (e.g., PCI DSS, HIPAA).
• Utilisation of enterprise-wide services like authentication and storage.
• Identification of application dependencies.

Importance of developing worksheets for security-related issues in mature development cycles.

Question 3

Security Application Requirements and Specifications

Answer 3

• Development of functional requirements and specifications post-conceptualization.
• Requirements and specs should be highly detailed and comprehensive.
• Characteristics that should be included in requirements and specifications:
  • User and administrative roles
  • Access control mechanisms
  • Audit logging
  • Configuration management
  • Workflow
  • Look and feel
  • Use cases
  • Reports
  • Interfaces to other systems
• Requirements and specifications serve as the basis for detailed test plans

Question 4

Security in Application Design

Answer 4

• Application design phase following specifications and requirements development.
• Design elements include database schema, input/output structures, workflows, roles, and integration points.
• Design should align seamlessly with technology environment.
• Review process involving developers and those who developed specs ensures accuracy.

Question 5

Threat Risk Modelling

Answer 5

• Conducted after design but before coding.
• Compares application design against known threats.
• Identifies threats requiring security controls.
• Tools for threat modeling:
  - Microsoft SDL Threat Modeling Tool
  - Minaccia
  - ThreatMind
  - Trike

Question 6

Security in Application Coding

Answer 6

• Application coding should align with specifications and design.
• Importance of addressing vulnerabilities during coding to avoid costly post-development fixes.
• Common vulnerabilities to avoid, including injection flaws, broken authentication, cross-site scripting, and more.
• Emphasis on using secure source code libraries and practices.

Question 7

Security in Testing

Answer 7

• Comprehensive testing after application development.
• Testing of all functional aspects based on detailed specifications.
• Security testing using specialized tools (e.g., WebInspect, AppScan) for web-based applications.
• Protecting the SDLC itself, including source code access control and safeguarding development tools and systems.