The practice of secure software development in SDLC: an investigation through existing model and a case study

Abstract

Software security is an essential requirement for software systems. However, recent investigation indicates that many software development methodologies do not explicitly include methods for incorporating information security into the software development life cycles (SDLC). This research investigates, using case study, the methodologies being used in software development in Saudi Arabia and describes a model for integrating security into the SDLC. The aim is to identify the appropriate means of introducing security measures much earlier in the SDLC. This model is designed to be an extension to the existing SDLC. For achieving the research objectives and answering the research questions, the research followed a case study research design in an information‐based organization. The research identified various important elements as security standards, policies, processes being practiced, and tools used within SDLC projects. In this regard, recommendations and verification were gathered to elicit the actual activities that are appropriate to be conducted at each phase of SDLC. The non‐functional security requirements were also found, to the use of fortify and hp alm for source code review and web application testing. Copyright © 2016 John Wiley & Sons, Ltd.

BlackWatch: Increasing Attack Awareness within Web Applications

“…Hasan et al [17] have also stressed the importance of integrating the SDLC. A model for ensuring security is built into the SDLC has previously been proposed [18], and others have investigated the use of such models, subsequently publishing a case study [19].…”

Systematic Mapping Study Protocol For Secure Software Engineering

“…Obviously, majority of software products undergoing live testing are vulnerable to threats and mostly fail to provide a secure and safe environment to clients and users. This is due to the lack of systematic evaluations such as systematic reviews, procedures, approaches, or frameworks as these evaluations could help project managers and software engineers to ensure that security processes are continuously followed throughout the software development process, according to a set of predefined procedures or rules (Karim, Albuolayan, Saba, & Rehman, 2016;Mundher, Muhamad, Rehman, Saba, & Kausar, 2014). To efficiently grip the security problems, that are present in during the development of applications, it is necessary to consider security-minded thinking throughout the development processes, which reduces the threats of missing essential security requirements or creating vital faults in software design .…”

Choosing the Best-fit Lifecycle Framework while Addressing Functionality and Security Issues

“…Software application developers can add security during any of the six stages of SDLC, and security need not be an afterthought. Studies have shown that software development efforts focus on functionality and usability and do not explicitly include cybersecurity in the SDLC process [7]. Due to competing priorities, software application developers often only focus on what they consider the core functionality and leave out security implementation for later stages [8,9].…”

“…However, each stage of SDLC lends itself to including security. The following table, adapted from Karim et al [7], shows some ways in which software application developers can incorporate security in each stage of SDLC.…”

“…The waterfall framework provides an opportunity to include security in all its phases, but there is a risk that security may be overlooked. Studies have shown that software development efforts focus on functionality and usability and can often exclude security in the SDLC process [7]. However, if the success criteria for software development include functionality and usability, as well as security, the software application developers will include it.…”