Download to read offline
Uploaded byAsankhaya Sharma
Secure Software Development
The document discusses secure software development. It recommends considering security throughout the software development lifecycle, from requirements to deployment. Key aspects discussed include identifying security requirements for sensitive data, applying principles for secure design like simplicity and defense in depth, implementing secure coding rules through code reviews and testing with techniques like fuzzing and penetration testing. The document also discusses methodologies like BSIMM and SDL and notes that continuous delivery requires continuous security integration and automation.
Secure Software Development
- 1. Secure Software Development Dr.Asankhaya Sharma SIT
- 2.
- 3. Secure Software Development •Consider security throughout the software development lifecycle – Requirements – Design – Implementation – Testing – Deployment 20-Feb-16 3
- 4. Requirements • Identify sensitivedata and resources • Define security requirements for them – Confidentiality – Integrity – Availability • Consider threats and abuse cases that violate these requirements 20-Feb-16 4
- 5. Application Specific •Abuse/Misuse Cases •Threat Models •Attacks •Assets Generic •CommonBest Practices •Legal •IT •Development Architectural Risk Analysis •Underlying Framework •Ambiguity Analysis •Fundamental Weakness Attack Patterns •Historical Risks •Vulnerabilities 20-Feb-16 5
- 6. Design • Apply principlesfor secure software design – Prevent, mitigate and detect possible attacks • Security principles – Favor Simplicity – Trust with Reluctance – Defend in Depth 20-Feb-16 6
- 7.
- 8. Implementation • Apply codingrules that implement secure design • Use automated code review techniques to find potential vulnerabilities components – Static Analysis – Symbolic execution 20-Feb-16 8
- 9.
- 10. Testing • Penetration Testingto find potential flaws in the real system – Fuzz testing • Employ attack patterns 20-Feb-16 10
- 11. Different methodologies • BSIMM(Building Security In – Maturity Model) – http://bsimm.com • Microsoft Security Development Lifecycle – https://www.microsoft.com/en-us/sdl/ • OpenSAMM Software Assurance Maturity Model – http://opensamm.org 20-Feb-16 11
- 12.
- 13. Continuous Delivery ofSoftware 20-Feb-16 13
- 14.
- 15. Continuous Security • Requiressecurity automation • Integrate into CD environment and tools – Source code management systems • GitHub, Bitbucket etc. – Build systems • Travis CI, Jenkins etc. • Audit third party component and open-source library usage 20-Feb-16 15
- 16. Takeaways • Security practicesshould be built in during the software development process • Continuous delivery needs continuous security 20-Feb-16 16
- 17. Thanks! • Questions? • Contact –@asankhaya 20-Feb-16 17