Question

The text book on page 123 introduces the concept of a secure system development lifecycle (SecSDLC). If you were running an information security program, what would be the key activities you would want to ensure are occurring before systems are promoted to production?

Answer 1

Generally speaking, a secure SDLC is set up by adding security-related activities to an existing development process. For example, writing security requirements alongside the collection of functional requirements, or performing an architecture risk analysis during the design phase of the SDLC.

There are definitely some actions that can be taken in your day-to-day activities to improve the security posture of your organization, including:

• Educate yourself and co-workers on the best secure coding practices and available frameworks for security.
• Consider security when building/planning for test cases.
• Use code scanning tools such as SecureAssist, Coverity, and AppScan Source

The Three Security Goals Are Confidentiality, Integrity, and Availability should be secured.

Here are certain components and documentation that your security program should include:

Charter — Your charter is an organizationally-approved document that defines how your security program will work in the context of the overall organization, with things such as scope, mission, mandate, and other things.

Policies — These define how your organization will address security issues. Policies are derived from your requirements and establish the standards and guidelines for your program.

Processes — Your processes are the procedures that ensure your security program is both repeatable and efficient. This document will help you identify the business rules, roles and responsibilities, and tools your organization will use to perform security activities.

Measurement — This is one of the most important security program components. Measuring how your program is performing in your environment will help you determine what improvements need to be made.