Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF)

Abstract

Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure the software being developed is well secured. This white paper recommends a core set of highlevel secure software development practices called a secure software development framework (SSDF) to be integrated within each SDLC implementation. The paper facilitates communications about secure software development practices among business owners, software developers, project managers and leads, and cybersecurity professionals within an organization. Following these practices should help software producers reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Also, because the framework provides a common vocabulary for secure software development, software consumers can use it to foster communications with suppliers in acquisition processes and other management activities.

Recommendations for IoT Device 2 Manufacturers:

“…Manufacturers should consider which, if any, secure development practices are most appropriate 759 for them and their customers as they further plan how to adequately support customer goals. Manufacturers can answer questions like the following based on expected customers and uses cases to help identify additional action to take towards cybersecurity: [28], which highlights selected practices for secure software development. Each of these practices is widely recommended by existing secure software development publications, and the white paper provides references from nearly 20 of these publications.…”

Core Cybersecurity Features Baseline for Securable IoT Devices: A Starting Point for IoT Device Manufacturers

“…The same recommendations for messaging discussed above apply 725 for follow-up communications, but extra care should be taken to avoid too many or contradictory follow-up messages, which could lead some customers, particularly home customers, to ignore important messages. [22] states, following secure software development practices should help manufacturers "reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. "…”

“…There are many existing standards, guidelines, and other publications on secure software development. IoT device manufacturers interested in more information can consult the NIST white paper on secure software development [22] which highlights selected practices for secure software development. Each of these practices is widely recommended by existing secure software development publications, and the white paper provides references from nearly 20 of these publications.…”

Workforce Framework for Cybersecurity (NICE Framework)

“…The first row illustrates that the team would consider objectives of the Design phase including planning, and thus would need a Security Architect.Table 3is an informative example and does not cover all the Work Roles that may be present or needed for a given Team. For more information, see NIST's Secure Software Development Framework [6].…”