The Application of a New Secure Software Development Life Cycle (S-SDLC) with Agile Methodologies

Abstract

The software development environment is focused on reaching functional products in the shortest period by making use of the least amount of resources possible. In this scenario, crucial elements such as software quality or software security are not considered at all, and in most cases, the high value offered to the projects is not taken into account. Nowadays, agile models are booming. They are defined by the way they achieve the interaction and integration of everyone involved in the software life cycle, the advantages of the quick reaction to change, and the implementation of artifacts or deliverables which display the level of progress reached at any time. In this context, it seems clearly necessary to define a new software development model, which prioritizes security aspects at any phase of the software life cycle and takes advantage of the benefits of the agile models. The proposed methodology shows that if security is considered from the beginning, vulnerabilities are easily detected and solved during the time planned for the project, with no extra time nor costs for the client and it increases the possibilities of reaching success in terms of not only functionality but also quality.

Synthesizing secure software development activities for linear and agile lifecycle models

“…Penetration testing, fuzz testing, security testing, and dynamic analysis are the four pillars of testing in secure agile models. 27 Mohino suggests ethical hacking, which covers penetration test as well. MSSDL-A has fuzz testing at four different levels.…”

On Combining Static, Dynamic and Interactive Analysis Security Testing Tools to Improve OWASP Top Ten Security Vulnerability Detection in Web Applications

“…Despite this problem, security code analysis can reduce the review code effort [26]. SAST tools are considered the most important security activity within a SSDLC [13].…”

“…Sometimes they have limited budgets. These cases often make them forget an essential component within the It is necessary to establish in the organizations a Software Development Life Cycle (SSDLC), as defined in the work of Vicente et al [13], in order to standardize the use of SAST, DAST and IAST tools with the objective of deploying in production web applications as secure as possible.…”

Malware Analysis in Web Application Security: An Investigation and Suggestion

“…A Mohaisen talks about antivirus malware identification methods with the help of machine level method for better results [19]. There are many other papers [20,21,22] related to machine level approaches for identification, classification, and analysis of malware. Table II combines the approaches with the application of research papers.…”