Secure coding

Introduction to Secure Software Development Life Cycle

The software development life cycle has seen many modifications and adjustments since it gained prominence in the 1970s. The developing needs of the end-users combined with the evolving nature of challenges — most notably in terms of security — have led to the formation of different software development approaches and methodologies over time. One of these approaches is the Secure Software Development Life Cycle (SSDLC).

SSDLC came into being as a response to the rising security challenges facing application security. Incidents involving data breaches, privacy violations and other cyberthreats are all too familiar in the present day, and any software development model not designed with security at the forefront will only result in financial and reputational losses for development firms.

There is a need and tangible benefits to having an SSDLC philosophy and application of a security-driven approach through each developmental phase of an SDLC.

But to fully understand and appreciate the importance of SSDLC, let us first look into the classical SDLC approaches.

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

Learn More

What is the Software Development Life Cycle?

The Software Development Life Cycle (SDLC) is a systematic yet standardized approach to developing software applications. SDLC borrows elements heavily from general project management life cycle approaches, as evident from the similarity in the steps and phases involved.

Although it is unlikely to find two firms applying perfectly identical SDLC processes, the main stages are common across most organizations.

The main stages of an SDLC process

Broadly speaking, five stages underlie a typical SDLC process:

1. Requirement gathering: Every application is developed to solve certain problems and offer utility to the user. When gathering requirements, the development team aims to understand the needs and goals of the customer and define the resources necessary to complete the project optimally.
2. Design: In this phase, the groundwork for the whole project is laid down. Some of the main details determined here include programming languages, architecture, platforms, user interface, communication protocols and security. 
3. Development/build: This is the part where all the planning is put into action by developing the source code of the application, and all the features of the app, including user interface and security, are implemented.
4. Testing: One of the most crucial components of any SDLC process is testing the software for bugs, errors, performance and functionality. Any issues with the performance of the application discovered in this phase are generally rectified before deployment.
5. Deploy and maintain: The application is released for the use of the intended clients. It often involves getting the app approved by the Google Play Store or the App Store and making it available for download. Of course, highly specialized corporate apps are not released on smartphone app stores and are usually directly provided to the client.

Popular software development life cycle models

The SDLC processes remain constant across organizations for the most part. However, there’s nothing in the software development rulebook that compels any developer to follow the SDLC stages in a single-dimensional order all the time.

Over the years, organizations and strategists have experimented with different SDLC models to better cater to customers’ changing requirements. The popular ones are below:

Waterfall

The most straightforward of all models is the waterfall methodology of SDLC. In waterfall, the stages of the entire development life cycle occur in a fixed sequence, starting from requirements gathering to final deployment.

Being the most rigid and bureaucratic of all models, water is mostly used in the following cases:

• Small to mid-sized projects having requirements that are unlikely to change.
• Projects where there is a need for strict control and compliance with regulations.

V-Model (validation and verification)

The V-model (the V stands for validation and verification) is a linear model, but its similarity with waterfall ends at this point.

The chief characteristic of this model is its heavy emphasis on testing. This is why the V-model is marked by each stage having its own testing activity so that testing takes place throughout all phases of development until completion.

The extensive testing and quality controls embedded in the V-model make it one of the most expensive and demanding software development approaches. As such, it’s only used in highly specialized situations, such as projects where the risk tolerance for failures and errors is marginal.

Iterative model

The iterative and incremental models have gained more prominence as organizations are exploring unconventional and non-linear work methodologies. Developers can implement this model in either a sequential or parallel fashion.

In essence, the iterative model is accumulative; new software modules and functionalities are added in each iteration.

The benefit of iterative models is that they allow adjustments during any development stage as long as changes in requirements are within the project’s scope.

Cases where iterative models prove the most effective are large projects where functionalities of the application are only loosely interdependent.

Agile

Today, agile is the most widely used SDLC model. Essentially, agile follows the iterative style of development and places greater emphasis on communication and early customer feedback.

Each iteration in the agile model aims to develop a complete module or functionality to be featured in the final version of the application. This means that the same sequence of steps in the conventional SDLC process is repeated multiple times until project completion, leading to repeated testing and quality assurance.

The frequent releases of software versions and communication and feedback with customers guaranteed by agile have made it a popular choice across most organizations.

Agile is particularly effective in cases such as:

• Startup initiatives requiring early customer feedback.
• Large projects that can be easily split into smaller parts, each developed incrementally.

The need for an additional “S” in SLDC

Now that we’ve considered SDLC in some detail, it’s relatively easy to introduce SSDLC. After all, SSDLC is only a natural progression of SDLC, occurring in response to the rising importance of security in the modern application development landscape.

Simply put, SSDLC provides a structured framework to application development aimed at strengthening security, integrating the element of security into all stages of SDLC.

In a world overrun by devices, gadgets and electronics, security vulnerabilities can spell disaster for people and organizations. If you’re a company, ignoring security can lead to huge financial losses. It only takes the exploitation of a single vulnerability to wreak havoc on an organization’s systems.

In the aftermath of serious data breach and privacy scandals such as Facebook-Cambridge Analytica, iCloud leaks, NSA’s PRISM surveillance program and the like, legislative frameworks such as the GDPR in the EU and CCPA in the U.S. require organizations to take data protection measures for the safety of all parties involved.

In this landscape, any software developer needs to make security the key consideration at every stage of the development life cycle.

SSLDC offers solutions to such security disasters, empowering organizations to minimize risks and take control of their reputation and financial security significantly more effectively. This is the main reason behind companies’ adoption of SSDLC.

SSDLC best practices

The classic SDLC stages require modification to integrate security strengthening activities throughout the entire process.

We briefly considered the main stages of a typical SDLC process at the start of this article. Now, let’s see how these steps are modified when security is integrated into each stage.

1. Requirement gathering

This stage now focuses on preparing a list of security and regulatory requirements and all the other general details of the project. A detailed plan is generally formulated, where the corresponding security assurance activities for all the different stages are laid down.

A crucial component of this stage is security awareness training. Training sessions aimed at providing security knowledge to the participants in the project equips them to take measures for secure design and development and establish a security mindset right from the outset for the whole team.

2. Design

As before, the design stage is where all the details, such as programming languages, software architecture, functionalities and user interfaces are decided. The SSDLC practices in this stage involve determining much of the security functionalities and defense mechanisms of the application.

Some key security-focused activities in this stage include:

• Threat modeling: Simulating attack scenarios and integrating effective countermeasures to the list of identified threats capable of compromising the application establishes the foundation for all subsequent security measures taken. Early detection of possible threats not only reduces the likelihood of successful attacks but also reduces costs associated with security integration for the whole project.
• Design documents and reviews: The modeling results help teams prepare design documents identifying security requirements and key vulnerabilities that need to be addressed for the security of the application.
• Identifying third-party risks: Even the most secure application is liable to attacks if the associated third-party components are vulnerable, rendering the whole system weak. Therefore, it is paramount to check and monitor possible security holes in third-party apps and apply patches as necessary for the integrity of the whole application system.

3. Development/build

This is the stage where all the implementation takes place. In the SSDLC context, the stage involves activities such as secure coding and scanning.

• Secure coding: Secure best practices for application coding such as authentication and encryption are taken care of in this stage. Typically, teams aim to follow secure coding practices, which successfully eliminates many basic vulnerabilities, minimizing the need for backtracking the same steps to fix and patch ignored vulnerabilities discovered later in the project.
• SAST: Static application scanning tools (SAST) have made it possible to test and review code before the application is complete. Static scanning helps discover security issues at any stage of development, making it easier to detect and fix issues as the project evolves.
• Manual code review: SAST provides automated scanning functionality. While it greatly facilitates developers, saving time and effort when it comes to discovering vulnerabilities, manual reviews can never be ignored entirely. Human supervision is still needed to identify potential issues in the code that malicious attackers could potentially exploit. 

4. Testing

The testing stage is where security testing goes into full swing under the SSDLC approach. Common practices performed during this stage include:

• Dynamic scanning: Unlike SAST, dynamic application scanner tools (DAST) simulate hacking attempts and threats at runtime to expose application vulnerabilities. Combined with SAST in the previous stage, DAST adds an extra layer of testing that eliminates most security errors.
• Fuzzing: In fuzz testing, developers generate random inputs that mimic custom patterns and check if the application can handle these inputs. This helps build protection for problems like SQL injection, which is essentially a form of malicious input. 
• Penetration testing: Simulating attacks by inviting a third-party team of security professionals is one of the best ways of exposing hidden vulnerabilities in any system. It’s always possible for the developing team to overlook certain attack scenarios that the experience and knowledge of third-party experts might reproduce through penetration testing.

5. Deploy and maintain

The job of a developer doesn’t end when an application goes live. Apps have ecosystems of their own, and they must be managed, maintained and taken care of.

Some SSDLC practices in this stage include:

• Environment response: An application may be foolproof itself, but every application is only useful only in its relation to the larger ecosystem. Once an application is launched, monitoring the environment and its influence on the app’s behavior and integrity is a critical aspect of maintenance.
• Incident response plan: In the real world, no application truly immune to security breaches. An incident response plan prescribes the plans, actions, and procedures that your team must follow in the event of a breach. 
• Security checks: Threats and attacks are always evolving, and applications must evolve even faster to stay safe. Frequent security checks help protect applications from new forms of attacks and vulnerabilities.

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

Learn More

Using SSDLC successfully

In the traditional SLDC model, agile has supplanted traditional approaches of the development life cycle in a wide majority of organizations. However, the agile environment has been at odds with security-oriented practices and tools. This primarily stems from the extensive security testing that an agile methodology naturally demands. Since every stage is performed iteratively in agile, and because SSDLC has a security component embedded in every stage, agile teams may find the prospect of repeated testing daunting.

This suggests that organizations need to undergo serious cultural shifts for SSDLC to be successfully integrated into an agile environment. Within agile, security can no longer be treated as a mere afterthought but a habit that needs to be exercised daily.

At the same time, agile is not only about forming new security-friendly habits but also about weeding out any elements that are at odds with having security as a crucial component of the agile environment.

Organizations have only one way forward — to adapt and welcome security by enabling its integration through all stages and parts of development.

 

Sources:

What is a Secure Software Development Life Cycle, KirkpatrickPrice

Building security into the software life cycle, Foundstone

(Currently listed as “account suspended”) http://www.ijetmas.com/admin/resources/project/paper/f201509231443005088.pdf