SecSDM: A Model for Integrating Security into the Software Development Life Cycle

Abstract

Most traditional software development methodologies do not explicitly include a standardised method for incorporating information security into their life cycles. It is argued that security considerations should provide input into every phase of the Software Development Life Cycle (SDLC), from requirements gathering to design, implementation, testing and deployment. Therefore, to build more secure software applications, an improved software development process is required. The Secure Software Development Model (SecSDM), as described in this paper, is based on many of the recommendations provided by relevant international standards and best practices, for example, the ISO 7498-2 (1989) standard which addresses the underlying security services and mechanisms that form an integral part of the model.

BlackWatch: Increasing Attack Awareness within Web Applications

“…Hasan et al [17] have also stressed the importance of integrating the SDLC. A model for ensuring security is built into the SDLC has previously been proposed [18], and others have investigated the use of such models, subsequently publishing a case study [19].…”

A Risk-Based Approach to Formalise Information Security Requirements for Software Development

“…This work is an extension of that published in [2]. Where the focus of that paper was on integrating security into the software development life cycle (SDLC), this paper focuses on how to establish information security requirements to ensure the protection of the information assets implicated.…”

A Survey on Design Methods for Secure Software Development

“…Secure programming language selection is the important step to achieve secure implementation phase, through following a secure coding standard and standard guideline, some model suggest that implementation using secure language to achieve secure implementation, like Apvrille and Pourzandi [11], and S2D-ProM [17], where some other suggest to use secure coding standard guideline to achieve secure implementation like MS SDL [4,13], SecSDM [6,30], McGraw's SSDLC process [2], S2D-ProM, CLASP [18], MS SDL goes further and suggests that certain security assurance activities should be performed during implementation.…”

“…We must note that all these activities do not guarantee security of software but identify errors and vulnerability. Different models of SDLC models use these activities for testing phase such as the exception of AEGIS [5,31], SSDM [6], and SecSDM [30], all the processes recommend using multiple security assurance methods such as security testing, code reviews, static code analysis.…”

“…After that, security specification must be defined by stating the guidelines on how security will be achieved. Penetration Testing is the only SSD activity for the security assurance phase where Capabilities of the software in preventing attacks are tested here [6,30] …”