Secure Software Development
Actions, Skills, Costs
In software development since 1989 and in information security since 2003, ScienceSoft develops secure and compliant software and provides cybersecurity consulting services.
What is Secure Software Development: The Gist
Secure software development includes enabling software security (security requirements planning, designing a software architecture from a security perspective, adding security features, etc.) and maintaining the security of software and the underlying infrastructure (source code review, penetration testing).
The introduction of security practices will naturally increase the time and effort required for each SDLC stage. For example, strict code reviews lead to up to 20-30% coding time increase in comparison with a usual software development project. At the same time, it helps save millions in the future: the average cost of a data breach was reported to reach $3.86 million in 2020.
In software development since 1989 and in information security since 2003, ScienceSoft delivers full-range secure software consulting and development services for enterprises and product companies.
The introduction of security practices will naturally increase the time and effort required for each SDLC stage. For example, strict code reviews lead to up to 20-30% coding time increase in comparison with a usual software development project. At the same time, it helps save millions in the future: the average cost of a data breach was reported to reach $3.86 million in 2020.
In software development since 1989 and in information security since 2003, ScienceSoft delivers full-range secure software consulting and development services for enterprises and product companies.
Note: Loginetfocuses both on applying security in software development life cycles and establishing security across the development infrastructure, information storage policies, human resource and supplier management, assets used, communication channels, physical location, business operations, and more.
Stages of Secure Software Development
The number and the ‘depth’ of security measures will differ depending on the level of security you want to achieve. Below you can find an overview of security aspects and practices ScienceSoft commonly employs.
At the requirements gathering stage, our security specialists prepare an application risk profile. The document describes possible entry points for attackers and categorizes security risks by the severity level, including their impact and likelihood.
Relying on the risk profile as well as organizational security and privacy policies and standards, regulatory requirements (e.g, of HIPAA, PCI DSS, etc.), business analysts elicit and document security and resilience requirements for future software, including:
Relying on the risk profile as well as organizational security and privacy policies and standards, regulatory requirements (e.g, of HIPAA, PCI DSS, etc.), business analysts elicit and document security and resilience requirements for future software, including:
- Identification requirements
- Identifying the target aAuthentication requirementsudience, understanding and analyzing their wants and needs.
- Authorization requirements
- Integrity requirements
- Non-repudiation requirements
- Privacy requirements
- Survivability requirements
After Loginet’s team designed a high-level software architecture and established the major data flows and data entry points in the future application, they proceed with threat modeling. Our team performs the following activities:
- Decomposing the planned application architecture into functional components, determining threats to each of the components.
- Threats categorization and prioritization.
- Planning and prioritizing controls and countermeasures for possible attacks.
- Secure software architecture (e.g., employing application partitioning, container-based approach).
- Security features (cryptography (DES, 3DES, AES, RSA, blowfish), audit/log, user identification, verification and authorization (password-based, multi-factor, certificate-based, token-based, biometrics).
At this stage, Loginet developers:
- Employ secure coding practices to mitigate or minimize high-risk implementation-level vulnerabilities.
- Use only secure development tools (libraries, frameworks, etc.).
- Perform regular unit tests.
- Perform automated static code analysis.
- Conduct language-specific, checklist-based code peer reviews to detect types of vulnerabilities that can’t be identified by automated security review tools.
Key deliverables: security testing results report describing the uncovered security issues, their risk level, impact, and ways to eliminate them; security monitoring and incident response plan.
At this stage, Loginet’s team proceeds with:
- Conducting penetration testing of software and its infrastructure (black box, gray box, and white box pentesting); fixing identified security issues and conducting regression testing. Note: When we develop software iteratively, these activities are performed in every build.
- Final Security Review (FSR) by subject-matter security experts to verify that security risks identified in the course of the previous security activities have been properly addressed (fixed or have a mitigation plan in place).
- Creating an incident response procedure.
- Setting application security monitoring, performing manual and automated security regression testing.
- (if applicable) Submitting your application for external validation to officially attest compliance with industry regulations.
- Establishing a feedback process and tools for users, white hat hackers, etc. to report on revealed vulnerabilities.
Secure Software Development Services by Loginet
Secure software development consulting
- Helping shape software vision, eliciting and structuring software requirements, including security requirements.
- Designing secure software architecture, helping choose a tech stack.
- Developing a business case.
- Delivering PoC.
- Delivering a detailed development roadmap.
- Planning a DevSecOps strategy.
Secure software development
- Software requirements engineering, including security requirements.
- Secure software design.
- Development using the best practices of secure coding.
- Regular code reviews by security experts.
- Post-commit penetration testing (automated/manual).
- Establishing secure CI/CD pipelines.
Why Choose Loginet for Secure Software Development
- In software development since 1989.
- In information security since 2003.
- In security testing since 2015.
- Certified Ethical Hackers.
- An IBM Business Partner in Security Operations & Response since 2003.
- Quality-first approach based on a mature ISO 9001-certified quality management system.
- ISO 27001-certified security management based on comprehensive policies and processes, advanced security technology, and skilled professionals.
- ISO 13485-certified company to design and develop secure medical software according to the requirements of the FDA and the Council of the European Union.
Popular Sourcing Models for Secure Software Development
The entire secure software development process is kept in-house
- Full control over the development process, infrastructure, and security measures.
- Re-training existing resources or hiring additional staff since specific software security and resilience knowledge and skills are needed.
Partial outsourcing of secure software development project
- Security expertise of qualified outsourced resources helps to implement security at each stage of SDLC.
- Partial or total project team coordination, quality control and risk management are required from your side.
- Comprehensive vendor security audit is needed.
- Audit of all digital points between you and the vendor is required.
Full outsourcing of the secure software development process
- A vendor assumes full responsibility for the security across the whole development infrastructure, team assembly and management and the quality of the project results.
- Established secure software development practices and methodologies for each SDLC stage.
- High vendor risks.
- Comprehensive vendor security audit is needed.
Key Roles in Our Secure Software Development Teams
Project manager
- Plans time and budget to ensure that security and resilience requirements are thoroughly handled through the software development life cycle.
Business Analyst (BA)
- Gathers and documents functional and non-functional (including security and resilience) requirements from all software stakeholders.
- Helps with threat and countermeasure identification and assessment due to deep understanding of specific business processes and data.
- Determines the value of the data to be collected, stored and transmitted by planned software.
Security engineer / DevSecOps
- Identifies software security flaws at all SDLC stages.
- Prepares the application’s risk profile.
- Performs static and dynamic software analysis; automates these types of analysis, Helps to integrate security tools into CI/CD pipelines.
- Configures and implements computer security and networking diagnostic and monitoring tools.
- Identifies security risks to the infrastructure.
- Prepares incident response plans.
- Manages log analytics tools.
System architect
- Designs software architecture in accordance with security and resilience requirements.
Software engineer
- Develops secure backend and frontend employing secure coding practices.
Compliance (PCI DSS, HIPAA, etc.) expert
- Assumes ownership of all compliance requirements.
- Performs compliance audits and compiles reports.
- Documents compliance-related processes.
Pentester
- Plans and creates penetration scripts and tests.
- Simulates cyberattacks to expose and report weaknesses in security.
- Creates reports to document pentesting findings.
Want to Build Secure Software Fast?
Loginet offers end-to-end development of highly secure applications with minimized security risks at each SDLC stage.
Secure Software Development Costs
Where you spend
Introduction of secure software development practices requires additional skills and efforts (usually 20-80% added effort), which makes such projects more costly than those focused on ‘common’ software development.
To calculate the costs of secure development, ScienceSoft uses different cost estimation models. For example, the COCOMO-II model can estimate costs of incorporated security features:
ΔE (the additional effort required to develop secure software) = E (with security) – E (without security), where E is the level of effort in person/month (PM).
Where you win
Loginet’s customers that opt for secure software development and invest into eliminating vulnerabilities as early in the SDLC as possible:
- Spend less time on software repair as a result of in-depth comprehensive software assessment.
- Optimize software development costs by reducing cycle times and avoiding costs associated with delayed releases.
Overall, the return on establishing a secure software engineering framework is around 20%.
- Avoid huge data breach penalties and fines.
