subject: Securing the SDLC [print this page] Securing the SDLC Securing the SDLC
Securing the SDLC
The software development life cycle consists of three main phases:
Design phase
Development phase
Delivery phase
Each phase plays a role in the quality of the overall security of your final product and, therefore, must be considered from a security perspective.
Design phase
The design phase in the software development life cycle consists of creating requirements and designing the architecture of the application. To secure the software development life cycle, both the requirements and architecture design must be performed with security in mind. Almost every application suffers the potential of greatest weakness if the requirements and the architecture are not clearly designed, planned, and executed.
Within the scuba diving community, there is an important mantra, "plan the dive, and dive the plan." Failure to plan can result in serious consequences. While human life is not usually at stake, the same principle holds true for Web applications. The most catastrophic failures in software have occurred when the plan for the software is not robust and secure by design. Such a plan can be created by having a decent set of requirements and a design that fulfills them.
Consider a common scenario that relates to authentication. Research in the United States has shown that one in nine people uses one of the 500 most common passwords and that one of every 50 people uses one of the top 20 passwords. This is a big security problem, because for hackers, it is easy for them to use brute force passwords if they are on the 500 most common passwords list.
The commonly used way to counter this problem is to lock out any account that has too many failed attempts in a short period of time. However, hackers can try to avoid lockout by trying the most common passwords with different user names. There is little you can do since you do not want to lock out all accounts. Nor do you want to disable access from the attacking IP address out of fear that this will block legitimate users from coming through the same gateway.
Therefore, designing an application securely is essential. Having a requirement that your system cannot accept easy-to-guess passwords might be sufficient to prevent this. Of course, this requirement must be implemented correctly, which brings us to the next phase in the software development life cycle, which is the development phase. Improving Your Web Application Software Development Life Cycle's Security Posture 14
Development phase
The development phase is a three-step process in which code is written, built, and tested. Although many software development groups recognize the need for developing an application securely, experience has proven that developing a secure application is more than a little difficult. In fact, most of the reported vulnerabilities are the result of poor development practices. A typical example of a bad development practice is an inexperienced developer who writes a custom component and along the way introduces security vulnerability into the application. A much better practice is to use an existing, proven component from a mature framework that has been thoroughly tested for security vulnerabilities. In addition, educating the developer on secure development practices pays off in the future.
With the fast changing rich Web 2.0 UI designs, the imperative for secure code development becomes even more critical. The continuously changing Web 2.0 designs leave little space for thorough testing. On top of this, to maximize interactivity, a large part of the application code is run on the client browser and, therefore, can easily be viewed by the user. The organization must assume that the user will intentionally tamper with the exposed application business logic and try to exploit it to its own advantage.7 By integrating the right tools into the development process, many of the security-related tasks can be automated during the coding, building, and testing of your Web applications.
Delivery phase
The most securely designed and developed software fails to be secure when it is delivered in an insecure environment. This includes (but is not limited to) the hardening of the application infrastructure, protection of the data as it crosses the network, the defense of the production environment, and a patching and update strategy for the supporting operating system and components.
For example, failure to configure the Web server to deny access to the directory structure can allow a malicious user to gain direct access to sensitive information and application code. Therefore, a secure delivery phase exists from the final audit of the security of the application in its delivery environment and afterwards maintaining the security level of the operating environment. Again, a wide variety of tools can be used to automate these tasks.
