Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are going to secure our software development life cycle and have been researching for a good model to start with. I have found 3 major models (methodologies?) which are :

  1. Cigital SDLC (7 touch points )
  2. Microsoft SDLC
  3. OpenSAMM SDLC
  4. BSSIM

I couldn't choose either of them since i have no idea which one is best choice compared to other, I need some professionals to guide me on this based on their own experience on the projects and help us decide better.
What are the pros and cons of these models?
It would be great if anyone could guide us in a way that the difference between these models can be more clear. or if one suite some kind of projects better than the others.
We are going to secure the development a software project for a financial institute , so if this imposes some restrictions on the model we need to choose please guide us accordingly Thanks in advance

share|improve this question

closed as primarily opinion-based by Xander, Adnan, Noordung, Lucas Kauffman, Terry Chia Mar 12 at 15:12

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
The best software development process is always the one which works best for the project and your team. Every team is different and every project is different, so we can not really give you objective advise in this regard. –  Philipp Mar 9 at 18:24

3 Answers 3

up vote 3 down vote accepted

Personally, I found OpenSAMM to be a good resource, but only after you have something setup. It is a maturity model, which is basically a tool used to determine how well you do something. In other words, it has a focus on metrics and reporting. Don't get me wrong, I think there is a lot of good information in that document, but more of a phase 2.

I have not read Cigital, so I cannot comment on that one.

The MS SDLC is pretty simple to follow. We found most of the document irrelevant, especially when they get into specific things to check for c/c++ stuff and compiler flags, but the core concepts were good.

What you are going to have to do is take the SDLC and map the phases to what you do now. Once you have that mapping, you can then figure out what MS does in each phase and then pick a subset of that (or all of it) to include in your processes.

Think of the SDLC as the tool you will use to create the documents/process that the development team will follow. So, for example, you should probably publish a "development best practice guide" for the dev teams (as part of development training, for example). Since you guys are in the financial industry, you will want PCI/SOX stuff to be included in that document. To expand, the MS SDLC talks about having developer training. You will have to tailor that to your team and goals. For example, you may do a lot of c# training, so you will want to include c# training as part of your training goals.

Most of these models are going to come down to a couple of major components.

1) Build security in (at the requirements stage) Make sure you are looking at the correct docs / strategies, and that functional/non-functional requirements focus on security at the outset. Make sure your goals are aligned with that of the client. Create bug bars, etc. Make sure the architecture supports fail-safes, strong crypto, incident response, etc, etc

2) Train, train, train Developers need training. They preform better when they know what to do, and it is in the fore-front of their mind. Develop a training program that focuses on long term professional development as well as short term (as needed) training.

3) Deliver a secure product by following best practices, and then validate Develop according to best practices (pick a framework such as the ASVS, OWASP Top 10, or a combination), then make sure you validate that you have done it correctly. Do a pen test.

4) Support Make sure you build in the right processes to support your application/client going forward.

As a side note, if you are looking for some professional help, you should consider paying for someone to come in and help you.

share|improve this answer
    
Thanks a billion :-), Your response cleared my confusion on this subject. I would be grateful if you know about forums or websites which talk about such things , so that when we encounter any issue we can ask it and get further guidance:) –  Hossein Mar 11 at 11:42
2  
Not really. More of an art then a science. You could try joining the OpenSAMM mailing list. –  CtrlDot Mar 11 at 15:27

OpenSAMM with goals set to acheive certain ASVS levels per project. Then, give back to the OWASP community.

share|improve this answer

The idea behind Secure Development methodologies are, that you think about and address security concerns earlier in the project life-cycle

I would recommend using CLASP (Comprehensive, Lightweight Application Security Process) to get started on your current development methodology.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.