Software Development Security · Topic 1 of 4
Security in the Software Development Lifecycle
Integrating security into waterfall, agile and DevSecOps lifecycles, maturity models such as CMMI, SAMM and BSIMM, change management and integrated product teams.
- 3 min
- Security belongs in every SDLC phase, regardless of methodology.
- DevSecOps shifts security left with automated pipeline checks.
- CMMI levels: initial, managed, defined, quantitatively managed, optimizing.
What it is
The software development lifecycle (SDLC) is the process for planning, building, testing, releasing and maintaining software. Security must be part of every phase, regardless of method, because defects found late cost far more to fix than those prevented in design.
How it works
Development methodologies
| Method | Characteristics | Security integration |
|---|---|---|
| Waterfall | Sequential phases, little iteration | Security gates at each phase |
| Spiral | Iterative with risk analysis in each cycle | Risk assessment built in |
| Agile (Scrum and others) | Short iterations, changing requirements | Security user stories, security in the definition of done |
| Scaled agile frameworks | Agile across many teams | Shared security standards and architecture runway |
| DevOps | Development and operations working together with automation | Continuous delivery with automated checks |
| DevSecOps | DevOps with security built in throughout | Security tests in the pipeline; "shift left" |
| Rapid application development, prototyping | Fast iterations with users | Ensure prototypes do not become production unchecked |
Maturity models
| Model | Purpose |
|---|---|
| CMMI (Capability Maturity Model Integration) | Process maturity levels from initial (ad hoc) through managed, defined, quantitatively managed and optimizing |
| OWASP SAMM | Software Assurance Maturity Model for building and measuring a secure software program |
| BSIMM | Building Security In Maturity Model: describes practices observed in real organizations, for comparison |
SAMM is prescriptive (what to do to improve); BSIMM is descriptive (what other organizations actually do).
Operation and maintenance
Security continues after release: monitor, patch, respond to vulnerability reports, and retire software and its data properly.
Change management
All code and configuration changes go through version control, review and approval. Separation of duties keeps developers from deploying their own changes to production without review.
Integrated product teams
An integrated product team (IPT) brings together development, operations, security, quality assurance and business stakeholders from the start, so security requirements are understood and built in rather than added at the end.
Security activities by phase
| Phase | Activities |
|---|---|
| Requirements | Security and privacy requirements, abuse and misuse cases |
| Design | Threat modeling, secure design review |
| Implementation | Secure coding standards, peer review, static analysis |
| Testing | Dynamic testing, fuzzing, penetration testing |
| Deployment | Secure configuration, signed releases |
| Maintenance | Patching, monitoring, vulnerability management |
How the exam asks about this
- "Which maturity model describes practices observed in participating firms?" BSIMM.
- "When is fixing a security defect cheapest?" During requirements and design.
- "Agile teams skip security." Add security requirements to stories and the definition of done, and automate testing in the pipeline.
What to remember for the exam
- Security belongs in every SDLC phase, regardless of methodology.
- DevSecOps shifts security left with automated pipeline checks.
- CMMI levels: initial, managed, defined, quantitatively managed, optimizing.
- SAMM prescribes; BSIMM describes.
- IPTs bring security in from the start.
Prototypes and proofs of concept often skip security. Do not let them move into production without review.
Common mistakes
Testing for security only before release.
Assuming agile means no documentation of security requirements.
Confusing SAMM and BSIMM.
Check yourself
What does "shift left" mean?
Moving security activities earlier in the development lifecycle.
Which CMMI level describes processes that are measured and controlled with data?
Quantitatively managed.
What is an integrated product team?
A team combining development, operations, security, QA and business stakeholders from the start.
Topic 1 of 4 in Software Development Security
Test yourself on Software Development Security
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.