Agile development with security engineering activities

Abstract

Agile software development has been used by industry to create a more flexible and lean software development process, i.e making it possible to develop software at a faster rate and with more agility during development. There are however concerns that the higher development pace and lack of documentation are creating less secure software. We have therefore looked at three known Security Engineering processes, Microsoft SDL, Cigatel touchpoints and Common Criteria and identified what specific security activities they performed. We then compared these activities with an Agile development process that is used in industry. Developers, from a large telecommunication manufacturer, were interviewed to learn their impressions on using these security activities in an agile development process. We produced a security enhanced Agile development process that we present in this paper. This new Agile process use activities from already established security engineering processes that provide the benefit the developers wanted but did not hinder or obstruct the Agile process in a significant way.

Identification and Evaluation of Security Activities in Agile Projects

“…Ge et al [12] integrate feature-driven development and high-profile security methods, namely risk analysis, to address the development of secure web applications. Baca and Carlsson identify security activities from three SE processes; Microsoft SDL, Cigital touchpoints and Common Criteria [3,9]. Then, they compare those security activities with a specific agile development process, Scrum, which is used in industry.…”

“…Security engineering (SE) processes can be defined as the set of activities performed to develop, maintain and deliver a secure software product; security activities may be either sequential or iterative. Due to constraints such as a lack of a complete overview of a product, higher development pace and lack of documentation inherent to agile processes [6,8,9], existing SE processes are difficult to implement in such a setting. Moreover, existing SE processes are designed for a traditional waterfall development approach, i.e.…”

“…This process includes a set of 16 sequential activities that cover all parts of the software development life cycle. CC is an international standard, ISO15408, certified for computer security [9,17]. It helps developers to specify the security attributes of a product and to evaluate if the products meet their claims [17].…”

“…This process includes a set of 9 sequential activities that cover most parts of the software development life cycle, except the prerequirement phase. Two other (O) security activities that are commonly used in agile development recommended in [9,18,19] but not included in any of the SE processes mentioned above are also identified; countermeasure graphs and pair programming. Based on these SE processes, initially a total of 50 security activities were found: 16 CLASP, 16 SDL, 9 CT, 7 CC and 2 O.…”

Introducing a Novel Security-Enhanced Agile Software Development Process

“…Baca and Carlsson proposed an agile security process in an industrial setting (Baca & Carlsson, 2011). Security issues were addressed using three well-known security tools; Microsoft SDL, Cigital Touchpoints, and the Common Criteria (Common Criteria, 2017).…”