Agile Security Using an Incremental Security Architecture

Abstract

Abstract. The effective provision of security in an agile development requires a new approach: traditional security practices are bound to equally traditional development methods. However, there are concerns that security is difficult to build incrementally, and can prove prohibitively expensive to refactor. This paper describes how to grow security, organically, within an agile project, by using an incremental security architecture which evolves with the code. The architecture provides an essential bridge between system-wide security properties and implementation mechanisms, a focus for understanding security in the project, and a trigger for security refactoring. The paper also describes criteria that allow implementers to recognize when refactoring is needed, and a concrete example that contrasts incremental and 'top-down' architectures.

Extending XP practices to support security requirements engineering

“…Chivers et al discuss how a security architecture can evolve iteratively [10]. Another interesting example of a development process with explicit support for security requirements is AEGIS, which builds on the spiral model for software development [12].…”

“…The problems within security engineering mirror some of the inherent problems with traditional, waterfall based and documentdriven software development [10]. Existing security engineering standards are based on a sequential, non-iterative lifecycle and assume stable development environments where project plans and security requirements are defined, fixed and documented upfront.…”

Change-Impact Driven Agile Architecting

“…Several works propose the coexistence of software architectures and ASD [1] [3][5] [13][14] [19], and a few approaches present successful cases of agile architecture [18] or iterative architecture [8]. Agile architecture can defined as "the one that develops with the system, and includes only features that are necessary for the current iteration or delivery" [8].…”

Supporting Agile Development of Authorization Rules for SME Applications

“…-Security is difficult to retrofit [5], so that security ideally needs to be considered from the beginning. In Agile development, where having modifications of the plan is common, the functional requirements are by definition not clear at the beginning.…”