Integrating of security activates in agile process
Download as PPTX, PDF0 likes63 views
This document discusses integrating security activities into agile development processes. It outlines common security practices from frameworks like Microsoft SDL, Cigital Touchpoints, Common Criteria, and CLASP. The document presents a flow chart for integrating security into each stage of agile development, from planning and requirements to implementation and release. The goal is to leverage security best practices while maintaining agility.
Integrating of security activates in agile process
- 1. Integrating of Security Activates in Agile Process PRESENTER: ZUBAIR RAHIM 1
- 2. Presentation Outline 2 What is security Why We need security Agile development What is Agile Security Agile Security Manifesto Integration of Security in Agile Development Method Integration Method
- 3. What is cyber security 3 Cyber security or IT security, is the protection of computer systems from the theft or damage to their hardware, software or information, as well as from disruption or misdirection of the services they provide. (Wikipedia) It covers all aspects of ensuring the protection of citizens, businesses and critical infrastructures from threats that arise from their use of computers and the Internet. CIA
- 4. Why We need security 4 MORE THAN 2.5 BILLION RECORDS STOLEN 2017 ... The 2003 loss estimates by these firms range from $226 billion.
- 6. Agile Security 6 Today large parts of the industry have shifted software development from a former waterfall model to a more flexible agile software development process. So the industry experience, identify what practices from mature SE processes are easily integrated and also provide a benefit to agile projects.
- 7. Cigital’s “Agile Security Manifesto” 7 Rely on good developers and testers over security specialists 01 Implement secure architecture over adding security features afterwards 02 Continuously improve security over completely changing processes 03 Focus on fixing software over finding bugs 04
- 8. Integration of Security in Agile Development Method 8 The four highly profile SE processes 1. Microsoft SDL, 2. Cigital Touchpoints, 3. Common Criteria and 4. CLASP are investigated. Based on these investigations a total of 41 security activities are obtained.
- 9. 9
- 10. Cigatel Touchpoints 10 lightweight SE process
- 11. Common Criteria International set of guidelines and specifications developed for evaluating information security products. ISO certified Requirements Security Requirements Agree on definitions Design Risk Analyses Critical Assets UMLSec Requirements Inspection Release Repository Improvement 11
- 13. Comparison of secure software development standards and models 13
- 14. Integration Method It is good to use these security activities for a secure software development but may be with the integration of some heavy weight activities may lead to loss of agility of a process. To handle the issue of Integration of agile and security issue a flow chart is introduce. 14
- 15. 15
- 16. 16
Editor's Notes
- #7: SecDev checlilist: https://www.sqreen.com/checklists/devops-security-checklist It’s an engineering technique you can use to help you identify threats, attacks, vulnerabilities, and countermeasures that could affect your application. You can use threat modeling to shape your application's design, meet your company's security objectives, and reduce risk.
- #8: 2- Use SMEs to develop security features – E.g. authentication, authorization, data validation, crypto, etc Focus on fixing software over finding bugs • Penetration testing, secure code review etc. find issues, but they don’t magically fix them for you • Automated security tools are great at findings issues…… even if the issue doesn’t exist! – And they don’t fix the issues for you • Apply a risk-based approach to focus development effort on the issues that matter and that cannot be handled through other means – E.g. business process, contracts, monitoring, etc. • Use the development backlog to communicate and prioritise issues that need to be remediated
- #9: A comprehensive approach for agile development method selection and security enhancement A Sharma, RK Bawa - Proceedings of the International Journal of …, 2016 - ijiet.com
- #11: https://betanews.com/2016/07/21/new-approach-agile-security/
- #12: (Mellado, Fernandez-Medina, and Piattini 2006).
- #14: https://www.researchgate.net/publication/267704821_Review_on_Common_Criteria_as_a_Secure_Software_Development_Model
- #15: A comprehensive approach for agile development method selection and security enhancement A Sharma, RK Bawa - Proceedings of the International Journal of …, 2016 - ijiet.com