The document discusses secure software development. It recommends considering security throughout the software development lifecycle, from requirements to deployment. Key aspects discussed include identifying security requirements for sensitive data, applying principles for secure design like simplicity and defense in depth, implementing secure coding rules through code reviews and testing with techniques like fuzzing and penetration testing. The document also discusses methodologies like BSIMM and SDL and notes that continuous delivery requires continuous security integration and automation.

1. Secure Software Development
Dr. Asankhaya Sharma
SIT

2. 20-Feb-16 2

3. Secure Software Development
• Consider security throughout the software
development lifecycle
– Requirements
– Design
– Implementation
– Testing
– Deployment
20-Feb-16 3

4. Requirements
• Identify sensitive data and resources
• Define security requirements for them
– Confidentiality
– Integrity
– Availability
• Consider threats and abuse cases that violate
these requirements
20-Feb-16 4

5. Application
Specific
•Abuse/Misuse Cases
•Threat Models
•Attacks
•Assets
Generic
•Common Best
Practices
•Legal
•IT
•Development
Architectural Risk
Analysis
•Underlying
Framework
•Ambiguity Analysis
•Fundamental
Weakness
Attack Patterns
•Historical Risks
•Vulnerabilities
20-Feb-16 5

6. Design
• Apply principles for secure software design
– Prevent, mitigate and detect possible attacks
• Security principles
– Favor Simplicity
– Trust with Reluctance
– Defend in Depth
20-Feb-16 6

7. 20-Feb-16 7

8. Implementation
• Apply coding rules that implement secure
design
• Use automated code review techniques to
find potential vulnerabilities components
– Static Analysis
– Symbolic execution
20-Feb-16 8

9. 20-Feb-16 9

10. Testing
• Penetration Testing to find potential flaws in
the real system
– Fuzz testing
• Employ attack patterns
20-Feb-16 10

11. Different methodologies
• BSIMM (Building Security In – Maturity
Model)
– http://bsimm.com
• Microsoft Security Development Lifecycle
– https://www.microsoft.com/en-us/sdl/
• OpenSAMM Software Assurance Maturity
Model
– http://opensamm.org
20-Feb-16 11

12. 20-Feb-16 12

13. Continuous Delivery of Software
20-Feb-16 13

14. 20-Feb-16 14

15. Continuous Security
• Requires security automation
• Integrate into CD environment and tools
– Source code management systems
• GitHub, Bitbucket etc.
– Build systems
• Travis CI, Jenkins etc.
• Audit third party component and open-source
library usage
20-Feb-16 15

16. Takeaways
• Security practices should be built in during the
software development process
• Continuous delivery needs continuous security
20-Feb-16 16

17. Thanks!
• Questions?
• Contact
– @asankhaya
20-Feb-16 17