Hot answers tagged

20

Microsoft's guidelines for Security Development Life-cycle (SDL) for Agile recommends security practices during design, implementation, and release of the project. Regardless of the development methodology in use, no line of code should make it into production until it has undergone a security review. If financial constraints are preventing this level of ...


17

The short answer is: integrate security into your software development lifecycle. It should be integrated into every stage: design, implementation, and testing. There are many resources on how to build security into your software development lifecycle. See, e.g., Cigital's SDLC (the 7 touch points)], Microsoft's SDLC, OpenSAMM's SDLC, BSIMM, CERT's Build ...


5

If your security model is based around the concept of a point-in-time external audit of your entire codebase, then you're doing security wrong. ...And you're probably using the audit wrong too. But we'll get to that. Beyond question, all code needs to be audited for security. In many cases, this is actually a legal requirement: no code ships without an ...


3

As others have suggested, you can build in stories about security. And I would certainly encourage you to do that. But if you're talking about an external team coming in and spending several weeks doing an audit ... that, it seems to me, is more about agile than security. I know that agile places a heavy emphasis on shipping frequently -- after all, how ...


2

You can do audits for each release just like a waterfall project. Although you noted some problems with doing that, many security companies can work very effectively with agile projects. However, if you release frequently, the cost of this may be prohibitive. Another approach is to move testing in-house. If you buy a scanning tool, you can perform your own ...


2

Add misuse cases. If there is a feature that the system must exhibit, you use a use case. If there is a feature that the system must not exhibit, use a misuse case. "As a competitor, I want to query the database back end for company sensitive data; this must not happen." "As a hacktivist, I want to use the DMZ to reflect attacks at the government; this ...


1

You can use OpenSAMM or BSIMM frameworks to benchmark your development process in terms of security. After that you can calculate the risks for unimplemented/incomplete security practices to include in your main CSF-based risk assessment.


Only top voted, non community-wiki answers of a minimum length are eligible