Secure SDLC Improvement

SQE Consulting believes that the most secure applications have security built into them from the beginning.

We provide services to help companies weave secure development practices into their software development life cycle (SDLC) so that they address security every step of the way, from requirements to design to build to deployment and maintenance. Our experienced software development team works with your team to plug-in proven security processes and practices into your existing software development process or we can work with you to develop a secure software development process that suits your needs.

Our secure SDLC begins with defining security requirements along with the core business requirements for the project. Defining security requirements from the beginning helps application designers and developers to consider the security implications of the application and implement the security features at an optimal time. During the design phase or as you design the application the development team, with the help of a secure development expert, can review the design and architecture of the application, using the security requirements as a guide for how the application should deal with security issues. Having the security requirements defined from the onset of the project also allows the quality assurance team to develop test plans for the security features.

The next step in building security into an application is adding automated security testing to the build and Continuous Integration (CI) processes. While automated security testing doesn’t replace manual security testing, code review, or penetration testing, it does help the application delivery team spot and fix problems as they are created and helps the team know where to focus their hands-on security testing and security code reviews. This leads to the next practices that support creating secure applications, manual security testing, and secure code reviews. Both practices focus on the application as it is developed and try to find flaws in the implementation in order to fix those flaws. Along with secure code reviews, the technical team, with the help of a security expert, should perform architectural risk assessments on the application and any other applications or systems that interact with it.

Even the most securely developed application can easily fall prey to attackers if the deployment, management, and ongoing maintenance do not maintain the same level of security practices that development employed. Along with secure deployment and configuration practices, SQE Consulting recommends penetration testing or objective black box or grey box verification of an application overall security posture.

Finally, one of the key steps in developing a secure SDLC is understanding the security needs of the application and organization. This includes understanding the risk tolerance of the organization, the risk profile of the application, and the budget of the project, and coming up with a SDLC that addresses those factors in a balanced manner with the best security practices possible for the project.

For more information on SQE Consulting professional services, contact us at jmacnaughton@sqe.com or 904.278.0524 x 212.