SlideShare a Scribd company logo

Introduction of Secure Software Development Lifecycle

Download as pptx, pdf
Rishi Kant
Rishi Kant

This document provides an overview of secure software development lifecycle (S-SDLC) approaches. It discusses how dynamic application security testing (DAST) is typically integrated into organizations' development processes. It also identifies gaps not addressed by static and dynamic analysis tools, including that only 30% of risks are found and fixed and it takes an average of 316 days to remediate issues. The document then presents three S-SDLC models: waterfall, agile, and continuous integration/continuous delivery (CI/CD). It outlines the security activities and checkpoints integrated into each model's phases.

1 of 16

Download presentation

Your download has started
Downloaded 12 times
INTRODUCTION TO S- SDLC Rishi Kant
AGENDA About me DAST Process in typical organizations Classical Integration of DAST in SDLC Gaps of an AppSec Program Gaps aren’t covered by SAST & DAST tools Statistics analysis of remediation cost/stages AppSec. quality improvement approach S-SDLC | Type 1 | Waterfall S-SDLC | Type 2 | Agile Comparison of all 2 approach
ABOUT ME I am a Security professional with 13+ years of corporate experience in the field of Cyber Security, Information Security, Digital Forensics, GRC, IT Administration, Secure Software Development, Training, and company operations. I worked in various industry verticals such as Utilities, IT/ITES, E- Commerce, Government, BFSI and law-enforcement agencies. https://www.linkedin.com/in/hrishikant
DAST PROCESS IN TYPICAL ORGANIZATIONS TIMELINES 2/3 DAYS 10/15 DAYS 1/2 DAYS 1 DAY BUT CYCLIC Understanding the scope Perform tests as per the scope Report generation and clearing the doubts Cyclic phase for re check the issues
CLASSICAL INTEGRATION OF DAST IN SDLC Requirement Gathering Analysis Design Development Testing Deployment Maintenance DAS T Gaps in early phases *Dynamic Application Security Testing.
RISK SOFTWARE PROJECT PROGRESS IDENTIFY CONTROL IMPLEMEN T CONTROL VALIDATE CONTROL We have jumped straight to validation without identifying the root cause and implementing the appropriate controls to reduce application security risk. GAPS OF AN APPLICATION SECURITY PROGRAM
GAPS ARE NOT COVERED BY SAST & DAST TOOLS Source Code SAST & DAST Remediation 30% of total risks found & fixed average time to remediation = 316 days* 54% of risks found* 46% of risks are not found 70% of risks unaddressed 24% of risks found, not fixed 54% remediation rate* *Adapted from: National Institute of Standards and Technology. “Report on the Static Analysis Tool Exposition IV”. Gartner for Technical Professionals. “Application Security Think Big and Start with What Matters”. Veracode. “State of Software Security”, 2016. WhiteHat Security. “Web Applications Security Statistics Report”.
Source Code SAST & DAST Remediation 30% of total risks found & fixed average time to remediation = 316 days* 54% of risks found* 46%of risks are not found 70% of risks unaddressed 24% of risks found, not fixed 54% remediation rate* *Adapted from: National Institute of Standards and Technology. “Report on the Static Analysis Tool Exposition IV”. Gartner for Technical Professionals. “Application Security Think Big and Start with What Matters”. Veracode. “State of Software Security”, 2016. WhiteHat Security. “Web Applications Security Statistics Report”. GAPS ARE NOT COVERED BY SAST & DAST TOOLS
Source: Applied Software Measurement, Capers Jones, 1996 • Cost of remediation is always lesser in coding phases irrespective to number of bugs found. • Impact on services, risk delta is always increases as the SDLC phases increases. • Increase in effectiveness of controls help to decrease the number of bugs found and remediation costs. • Decrease the impact on reputation, brand, business, reliability. STATISTICS ANALYSIS OF REMEDIATION COST/STAGES “The cost of removing an application security vulnerability during the design phase ranges from 30-60 times less than if removed during production.” NIST, IBM, and Gartner Group
APPLICATION SEC. QUALITY IMPROVEMENT APPROACH Definition Pre-Design Design Development Deployment CheckPoint 1 CheckPoint 2 CheckPoint 3 CheckPoint 4 CheckPoint 5 Concepts / Priority Selection of Controls Preliminary Design AGREEMENT Design & Review Approve Build • High Level Security Risk Analysis • Risk Base Security Plan • Selection of Controls • Selection of Service, protocols • Security Design Review • Third part assets control selection • Secure Code review • Data flow review • Vulnerability Assessment • Penetration testing • Third party assessment
WATERFALL APPROACH FOR S-SDLC Business Requirements Application Portfolio Analysis | User Risk Analysis | Security Requirements Analysis Pre-Design Secure Design Analysis | Risk Assessment | Architecture Review Plan | Threat Modeling Design External Security Review | Design Risk Analysis | Architecture Risk Analysis Post-Design Dev. Test Plan | Review of Data Flow charts | Communication channels/Services Development Secure Code Guidelines | Static Code Analysis | Developer Training | Coding Standards Development Testing Security Metrics Development | Test Reviews | Dynamic Code Analysis | DAST Deployment Pre-Implementation Risk Management Maintenance
AGILE APPROACH FOR S-SDLC Initial Phase Application Portfolio Analysis | User Risk Analysis | Required Training Creation User Stories Secure Design Analysis | Risk Assessment | Architecture Review Plan | Security Requirement Analysis Creation Product Backlogs Design Risk Analysis | Architecture Risk Analysis | Threat Modelling Creation Sprint Backlogs Security Metrics Development | Communication channels/Services | Secure Code Guidelines | Coding Standards Development Sprint Lifecycle Static Code Analysis | Developer Training | Dynamic Code Analysis | DAST Finishing Sprint Test Reviews | Pre-Implementation Risk Management Sprint Retrospective Feedbacks | Security Improvement Plan Maintenance
GENERAL AGILE SDLC Client Product Owner Sprint Plan Meeting DevSecOps Team User Stories Sprint Backlog Sprint Life Cycle Product Backlog Finish of Sprint Sprint Review Sprint Retrospective Feedbacks • Product owner accept the inputs from the Client to conclude the user stories for product backlog. • Every product backlog further divided into sprint backlog as per the group of same type of functionalities. • Every Sprint backlog have the cycle of Coding and testing aligned with daily follow-up scrum meeting with scrum master, product owner, developers. • Scrum meeting is on daily basis for better analysis the growth of the project. • On the finish of Sprint, we need to review followed by Sprint retrospective for feedback to product owner likely for gaps evaluation. Security Champ.
CI/CD APPROACH S-SDLC Continuous Delivery Continuous Integration PRO UAT QA DEV Version Control Developer 1 Developer 1Scrum Master Service Desk 1 2 3 4 5 6 7 Check 4 Changes Fetch Changes Notify issues Send Backlog
WATERFALL | AGILE | CI/CD IN S-SDLC • Waterfall SDLC easy to alignment with Secure SDLC irrespective to Agile & CI/CD methodologies. • Waterfall model follow the consecutive process irrespective to Agile & CI/CD methodologies. • Implementation of Security in waterfall is easier then Agile & CICD but we can use some enhanced criteria for better & secure agile/CI/CD SDLCs Business Require ments Application Portfolio Analysis | User Risk Analysis | Security Requirements Analysis Pre- Design Secure Design Analysis | Risk Assessment | Architecture Review Plan | Threat Modeling Design External Security Review | Design Risk Analysis | Architecture Risk Analysis Post- Design Dev. Test Plan | Review of Data Flow charts | Communication channels/Services Develop ment Secure Code Guidelines | Static Code Analysis | Developer Training | Coding Standards Development Testing Security Metrics Development | Test Reviews | Dynamic Code Analysis | DAST Deploy ment Pre-Implementation Risk Management Secure SDLC in Waterfall Secure SDLC in Agile Secure SDLC in CI/CD * Perfectly aligned with security blocks * Hard to fit as per the security blocks Continuous Delivery Continuous Integration PRO UAT QA DEV Version Control Deve lope r 1 Deve lope r 1 S c r u m M a s t e r S e r v i c e D e s k 1 2 3 4 5 6 7 Check 4 Changes Fetch Changes Notify issues Send Backlog * Hard to fit as per the security blocks
THANK YOU! Any questions? You can also find me at rishi-kant@live.in for any further questions

Recommended

Machine Learning in Cyber Security
Machine Learning in Cyber SecurityMachine Learning in Cyber Security
Machine Learning in Cyber Security
Rishi Kant
 
Practical Applications of Machine Learning in Cybersecurity
Practical Applications of Machine Learning in CybersecurityPractical Applications of Machine Learning in Cybersecurity
Practical Applications of Machine Learning in Cybersecurity
scoopnewsgroup
 
Information Security Assessment Offering
Information Security Assessment OfferingInformation Security Assessment Offering
Information Security Assessment Offering
eeaches
 
Secure Design: Threat Modeling
Secure Design: Threat ModelingSecure Design: Threat Modeling
Secure Design: Threat Modeling
Cigital
 
security_assessment_slides
security_assessment_slidessecurity_assessment_slides
security_assessment_slides
Steve Arnold
 
OWASP based Threat Modeling Framework
OWASP based Threat Modeling FrameworkOWASP based Threat Modeling Framework
OWASP based Threat Modeling Framework
Chaitanya Bhatt
 
Cognitive automation with machine learning in cyber security
Cognitive automation with machine learning in cyber securityCognitive automation with machine learning in cyber security
Cognitive automation with machine learning in cyber security
Rishi Kant
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
S.E. CTS CERT-GOV-MD
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
AlienVault
 
The Incident Response Playbook for Android and iOS
The Incident Response Playbook for Android and iOSThe Incident Response Playbook for Android and iOS
The Incident Response Playbook for Android and iOS
Priyanka Aash
 
Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Mapping the Enterprise Threat, Risk, and Security Control Landscape with SplunkMapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Andrew Gerber
 
GDPR: The Application Security Twist
GDPR: The Application Security TwistGDPR: The Application Security Twist
GDPR: The Application Security Twist
Security Innovation
 
5 things i wish i knew about sast (DSO-LG July 2021)
5 things i wish i knew about sast (DSO-LG July 2021)5 things i wish i knew about sast (DSO-LG July 2021)
5 things i wish i knew about sast (DSO-LG July 2021)
Michael Man
 
The Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your StoryThe Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your Story
Priyanka Aash
 
Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Integrated Security Operations Center (ISOC) for Cybersecurity CollaborationIntegrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Priyanka Aash
 
Application Threat Modeling In Risk Management
Application Threat Modeling In Risk ManagementApplication Threat Modeling In Risk Management
Application Threat Modeling In Risk Management
Mel Drews
 
Business cases for software security
Business cases for software securityBusiness cases for software security
Business cases for software security
Marco Morana
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
Ben Rothke
 
Software Security Initiatives
Software Security InitiativesSoftware Security Initiatives
Software Security Initiatives
Marco Morana
 
Application of Machine Learning in Cyber Security
Application of Machine Learning in Cyber SecurityApplication of Machine Learning in Cyber Security
Application of Machine Learning in Cyber Security
Dr. Umesh Rao.Hodeghatta
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
CMR WORLD TECH
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Security metrics
Security metrics Security metrics
Security metrics
PRAYAGRAJ11
 
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive securityCisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
NetworkCollaborators
 
How Machine Learning & AI Will Improve Cyber Security
How Machine Learning & AI Will Improve Cyber SecurityHow Machine Learning & AI Will Improve Cyber Security
How Machine Learning & AI Will Improve Cyber Security
DevOps.com
 
IIC IoT Security Maturity Model: Description and Intended Use
IIC IoT Security Maturity Model: Description and Intended UseIIC IoT Security Maturity Model: Description and Intended Use
IIC IoT Security Maturity Model: Description and Intended Use
Kaspersky
 
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
NJVC, LLC
 
Adaptive & Unified Approach to Risk Management & Compliance-via-ccf
Adaptive & Unified Approach to Risk Management & Compliance-via-ccfAdaptive & Unified Approach to Risk Management & Compliance-via-ccf
Adaptive & Unified Approach to Risk Management & Compliance-via-ccf
awish11
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC Framework
Rishi Kant
 
Applicaiton Security - Building The Audit Program
Applicaiton Security - Building The Audit ProgramApplicaiton Security - Building The Audit Program
Applicaiton Security - Building The Audit Program
Michael Davis
 

More Related Content

What's hot (20)

Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
AlienVault
 
The Incident Response Playbook for Android and iOS
The Incident Response Playbook for Android and iOSThe Incident Response Playbook for Android and iOS
The Incident Response Playbook for Android and iOS
Priyanka Aash
 
Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Mapping the Enterprise Threat, Risk, and Security Control Landscape with SplunkMapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Andrew Gerber
 
GDPR: The Application Security Twist
GDPR: The Application Security TwistGDPR: The Application Security Twist
GDPR: The Application Security Twist
Security Innovation
 
5 things i wish i knew about sast (DSO-LG July 2021)
5 things i wish i knew about sast (DSO-LG July 2021)5 things i wish i knew about sast (DSO-LG July 2021)
5 things i wish i knew about sast (DSO-LG July 2021)
Michael Man
 
The Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your StoryThe Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your Story
Priyanka Aash
 
Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Integrated Security Operations Center (ISOC) for Cybersecurity CollaborationIntegrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Priyanka Aash
 
Application Threat Modeling In Risk Management
Application Threat Modeling In Risk ManagementApplication Threat Modeling In Risk Management
Application Threat Modeling In Risk Management
Mel Drews
 
Business cases for software security
Business cases for software securityBusiness cases for software security
Business cases for software security
Marco Morana
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
Ben Rothke
 
Software Security Initiatives
Software Security InitiativesSoftware Security Initiatives
Software Security Initiatives
Marco Morana
 
Application of Machine Learning in Cyber Security
Application of Machine Learning in Cyber SecurityApplication of Machine Learning in Cyber Security
Application of Machine Learning in Cyber Security
Dr. Umesh Rao.Hodeghatta
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
CMR WORLD TECH
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Security metrics
Security metrics Security metrics
Security metrics
PRAYAGRAJ11
 
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive securityCisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
NetworkCollaborators
 
How Machine Learning & AI Will Improve Cyber Security
How Machine Learning & AI Will Improve Cyber SecurityHow Machine Learning & AI Will Improve Cyber Security
How Machine Learning & AI Will Improve Cyber Security
DevOps.com
 
IIC IoT Security Maturity Model: Description and Intended Use
IIC IoT Security Maturity Model: Description and Intended UseIIC IoT Security Maturity Model: Description and Intended Use
IIC IoT Security Maturity Model: Description and Intended Use
Kaspersky
 
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
NJVC, LLC
 
Adaptive & Unified Approach to Risk Management & Compliance-via-ccf
Adaptive & Unified Approach to Risk Management & Compliance-via-ccfAdaptive & Unified Approach to Risk Management & Compliance-via-ccf
Adaptive & Unified Approach to Risk Management & Compliance-via-ccf
awish11
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
AlienVault
 
The Incident Response Playbook for Android and iOS
The Incident Response Playbook for Android and iOSThe Incident Response Playbook for Android and iOS
The Incident Response Playbook for Android and iOS
Priyanka Aash
 
Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Mapping the Enterprise Threat, Risk, and Security Control Landscape with SplunkMapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Mapping the Enterprise Threat, Risk, and Security Control Landscape with Splunk
Andrew Gerber
 
GDPR: The Application Security Twist
GDPR: The Application Security TwistGDPR: The Application Security Twist
GDPR: The Application Security Twist
Security Innovation
 
5 things i wish i knew about sast (DSO-LG July 2021)
5 things i wish i knew about sast (DSO-LG July 2021)5 things i wish i knew about sast (DSO-LG July 2021)
5 things i wish i knew about sast (DSO-LG July 2021)
Michael Man
 
The Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your StoryThe Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your Story
Priyanka Aash
 
Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Integrated Security Operations Center (ISOC) for Cybersecurity CollaborationIntegrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration
Priyanka Aash
 
Application Threat Modeling In Risk Management
Application Threat Modeling In Risk ManagementApplication Threat Modeling In Risk Management
Application Threat Modeling In Risk Management
Mel Drews
 
Business cases for software security
Business cases for software securityBusiness cases for software security
Business cases for software security
Marco Morana
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
Ben Rothke
 
Software Security Initiatives
Software Security InitiativesSoftware Security Initiatives
Software Security Initiatives
Marco Morana
 
Application of Machine Learning in Cyber Security
Application of Machine Learning in Cyber SecurityApplication of Machine Learning in Cyber Security
Application of Machine Learning in Cyber Security
Dr. Umesh Rao.Hodeghatta
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
CMR WORLD TECH
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
Ahmad Haghighi
 
Security metrics
Security metrics Security metrics
Security metrics
PRAYAGRAJ11
 
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive securityCisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
Cisco Connect 2018 Malaysia - Risk less, achieve more with proactive security
NetworkCollaborators
 
How Machine Learning & AI Will Improve Cyber Security
How Machine Learning & AI Will Improve Cyber SecurityHow Machine Learning & AI Will Improve Cyber Security
How Machine Learning & AI Will Improve Cyber Security
DevOps.com
 
IIC IoT Security Maturity Model: Description and Intended Use
IIC IoT Security Maturity Model: Description and Intended UseIIC IoT Security Maturity Model: Description and Intended Use
IIC IoT Security Maturity Model: Description and Intended Use
Kaspersky
 
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
Health IT Cyber Security HIPAA Summit Presentation: Metrics and Continuous Mo...
NJVC, LLC
 
Adaptive & Unified Approach to Risk Management & Compliance-via-ccf
Adaptive & Unified Approach to Risk Management & Compliance-via-ccfAdaptive & Unified Approach to Risk Management & Compliance-via-ccf
Adaptive & Unified Approach to Risk Management & Compliance-via-ccf
awish11
 

Similar to Introduction of Secure Software Development Lifecycle (20)

Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC Framework
Rishi Kant
 
Applicaiton Security - Building The Audit Program
Applicaiton Security - Building The Audit ProgramApplicaiton Security - Building The Audit Program
Applicaiton Security - Building The Audit Program
Michael Davis
 
Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)
Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)
Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)
TelecomValley
 
DevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOps
DevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOpsDevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOps
DevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOps
Suman Sourav
 
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
lior mazor
 
AutoSpice Agile Hand in Hand
AutoSpice Agile Hand in HandAutoSpice Agile Hand in Hand
AutoSpice Agile Hand in Hand
Ruchika Sachdeva
 
Comparitive Analysis of Secure SDLC Models
Comparitive Analysis of Secure SDLC ModelsComparitive Analysis of Secure SDLC Models
Comparitive Analysis of Secure SDLC Models
IRJET Journal
 
24may 1200 valday eric anklesaria 'secure sdlc – core banking'
24may 1200 valday eric anklesaria 'secure sdlc – core banking'24may 1200 valday eric anklesaria 'secure sdlc – core banking'
24may 1200 valday eric anklesaria 'secure sdlc – core banking'
Positive Hack Days
 
Eric Anklesaria. Secure SDLC - Core Banking
Eric Anklesaria. Secure SDLC - Core BankingEric Anklesaria. Secure SDLC - Core Banking
Eric Anklesaria. Secure SDLC - Core Banking
Positive Hack Days
 
Secure SDLC in mobile software development.
Secure SDLC in mobile software development.Secure SDLC in mobile software development.
Secure SDLC in mobile software development.
Mykhailo Antonishyn
 
Digital Product Security
Digital Product SecurityDigital Product Security
Digital Product Security
SoftServe
 
SDLC Models and Their Implementation
SDLC Models and Their ImplementationSDLC Models and Their Implementation
SDLC Models and Their Implementation
Sonal Tiwari
 
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
NetSPI
 
Software_Testing.pptx
Software_Testing.pptxSoftware_Testing.pptx
Software_Testing.pptx
VinodhSivaraman2
 
Integrated Security for Software Development and Advanced Penetration Testing...
Integrated Security for Software Development and Advanced Penetration Testing...Integrated Security for Software Development and Advanced Penetration Testing...
Integrated Security for Software Development and Advanced Penetration Testing...
Symptai Consulting Limited
 
Securing 100 products - How hard can it be?
Securing 100 products - How hard can it be?Securing 100 products - How hard can it be?
Securing 100 products - How hard can it be?
Priyanka Aash
 
CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)
CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)
CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)
CISQ - Consortium for IT Software Quality
 
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
Brian Levine
 
Bridging the Security Testing Gap in Your CI/CD Pipeline
Bridging the Security Testing Gap in Your CI/CD PipelineBridging the Security Testing Gap in Your CI/CD Pipeline
Bridging the Security Testing Gap in Your CI/CD Pipeline
DevOps.com
 
Cyber security series Application Security
Cyber security series Application SecurityCyber security series Application Security
Cyber security series Application Security
Jim Kaplan CIA CFE
 
Secure SDLC Framework
Secure SDLC FrameworkSecure SDLC Framework
Secure SDLC Framework
Rishi Kant
 
Applicaiton Security - Building The Audit Program
Applicaiton Security - Building The Audit ProgramApplicaiton Security - Building The Audit Program
Applicaiton Security - Building The Audit Program
Michael Davis
 
Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)
Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)
Soirée du Test Logiciel - Présentation de Kiuwan (Jack ABDO)
TelecomValley
 
DevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOps
DevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOpsDevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOps
DevSecOps Indonesia : Pain & Pleasure of doing AppSec in DevOps
Suman Sourav
 
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...Application Security - Dont leave your AppSec for the last moment Meetup 2104...
Application Security - Dont leave your AppSec for the last moment Meetup 2104...
lior mazor
 
AutoSpice Agile Hand in Hand
AutoSpice Agile Hand in HandAutoSpice Agile Hand in Hand
AutoSpice Agile Hand in Hand
Ruchika Sachdeva
 
Comparitive Analysis of Secure SDLC Models
Comparitive Analysis of Secure SDLC ModelsComparitive Analysis of Secure SDLC Models
Comparitive Analysis of Secure SDLC Models
IRJET Journal
 
24may 1200 valday eric anklesaria 'secure sdlc – core banking'
24may 1200 valday eric anklesaria 'secure sdlc – core banking'24may 1200 valday eric anklesaria 'secure sdlc – core banking'
24may 1200 valday eric anklesaria 'secure sdlc – core banking'
Positive Hack Days
 
Eric Anklesaria. Secure SDLC - Core Banking
Eric Anklesaria. Secure SDLC - Core BankingEric Anklesaria. Secure SDLC - Core Banking
Eric Anklesaria. Secure SDLC - Core Banking
Positive Hack Days
 
Secure SDLC in mobile software development.
Secure SDLC in mobile software development.Secure SDLC in mobile software development.
Secure SDLC in mobile software development.
Mykhailo Antonishyn
 
Digital Product Security
Digital Product SecurityDigital Product Security
Digital Product Security
SoftServe
 
SDLC Models and Their Implementation
SDLC Models and Their ImplementationSDLC Models and Their Implementation
SDLC Models and Their Implementation
Sonal Tiwari
 
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
Application Risk Prioritization - Overview - Secure360 2015 - Part 1 of 2
NetSPI
 
Software_Testing.pptx
Software_Testing.pptxSoftware_Testing.pptx
Software_Testing.pptx
VinodhSivaraman2
 
Integrated Security for Software Development and Advanced Penetration Testing...
Integrated Security for Software Development and Advanced Penetration Testing...Integrated Security for Software Development and Advanced Penetration Testing...
Integrated Security for Software Development and Advanced Penetration Testing...
Symptai Consulting Limited
 
Securing 100 products - How hard can it be?
Securing 100 products - How hard can it be?Securing 100 products - How hard can it be?
Securing 100 products - How hard can it be?
Priyanka Aash
 
CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)
CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)
CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)
CISQ - Consortium for IT Software Quality
 
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
A Warrior's Journey: Building a Global AppSec Program - OWASP Global AppSec 2020
Brian Levine
 
Bridging the Security Testing Gap in Your CI/CD Pipeline
Bridging the Security Testing Gap in Your CI/CD PipelineBridging the Security Testing Gap in Your CI/CD Pipeline
Bridging the Security Testing Gap in Your CI/CD Pipeline
DevOps.com
 
Cyber security series Application Security
Cyber security series Application SecurityCyber security series Application Security
Cyber security series Application Security
Jim Kaplan CIA CFE
 

Recently uploaded (20)

DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
Bangladesh Network Operators Group
 
DATA COMMUNICATION components, modes of transmission & communication devices ...
DATA COMMUNICATION components, modes of transmission & communication devices ...DATA COMMUNICATION components, modes of transmission & communication devices ...
DATA COMMUNICATION components, modes of transmission & communication devices ...
samina khan
 
Network Efficiency:The LLM Advantage on network infrastructures
Network Efficiency:The LLM Advantage on network infrastructuresNetwork Efficiency:The LLM Advantage on network infrastructures
Network Efficiency:The LLM Advantage on network infrastructures
Bangladesh Network Operators Group
 
Bsjsudhjsidudjdudjdudidjjdjdkdel-se-br.ppt
Bsjsudhjsidudjdudjdudidjjdjdkdel-se-br.pptBsjsudhjsidudjdudjdudidjjdjdkdel-se-br.ppt
Bsjsudhjsidudjdudjdudidjjdjdkdel-se-br.ppt
ssuserb171f7
 
Mikotik_Load_Balancing_workshop_best_practice
Mikotik_Load_Balancing_workshop_best_practiceMikotik_Load_Balancing_workshop_best_practice
Mikotik_Load_Balancing_workshop_best_practice
davidarmandorodrigue
 
Unlocking the Power of SIM Card IoT Connectivity.pdf
Unlocking the Power of SIM Card IoT Connectivity.pdfUnlocking the Power of SIM Card IoT Connectivity.pdf
Unlocking the Power of SIM Card IoT Connectivity.pdf
elite virtual staffing solutions
 
Concept and purpose of community diagnosis
Concept and purpose of community diagnosisConcept and purpose of community diagnosis
Concept and purpose of community diagnosis
felixsakwa55
 
Integration of AI and GenAI in Education and beyond
Integration of AI and GenAI in Education and beyondIntegration of AI and GenAI in Education and beyond
Integration of AI and GenAI in Education and beyond
Bangladesh Network Operators Group
 
Transport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptx
Transport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptxTransport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptx
Transport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptx
ssuser80a7e81
 
Essential Tech Stack for Effective Shopify Dropshipping Integration.pdf
Essential Tech Stack for Effective Shopify Dropshipping Integration.pdfEssential Tech Stack for Effective Shopify Dropshipping Integration.pdf
Essential Tech Stack for Effective Shopify Dropshipping Integration.pdf
CartCoders
 
Mental Health and Workplace Culture in Tech:A Personal Perspective
Mental Health and Workplace Culture in Tech:A Personal PerspectiveMental Health and Workplace Culture in Tech:A Personal Perspective
Mental Health and Workplace Culture in Tech:A Personal Perspective
Bangladesh Network Operators Group
 
Presentation About The Buttons | Selma SALTIK
Presentation About The Buttons | Selma SALTIKPresentation About The Buttons | Selma SALTIK
Presentation About The Buttons | Selma SALTIK
SELMA SALTIK
 
Fast Reroute in SR-MPLS by Md Abdullah Al Naser
Fast Reroute in SR-MPLS by Md Abdullah Al NaserFast Reroute in SR-MPLS by Md Abdullah Al Naser
Fast Reroute in SR-MPLS by Md Abdullah Al Naser
Bangladesh Network Operators Group
 
all Practical Project LAST summary note.docx
all Practical Project LAST summary note.docxall Practical Project LAST summary note.docx
all Practical Project LAST summary note.docx
seidjemal94
 
Paper: QFS: World Game (s) Great Redesign.pdf
Paper: QFS: World Game (s) Great Redesign.pdfPaper: QFS: World Game (s) Great Redesign.pdf
Paper: QFS: World Game (s) Great Redesign.pdf
Steven McGee
 
DDoS Mitigation Strategies by Md. Abdul Awal
DDoS Mitigation Strategies by Md. Abdul AwalDDoS Mitigation Strategies by Md. Abdul Awal
DDoS Mitigation Strategies by Md. Abdul Awal
Bangladesh Network Operators Group
 
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
Bangladesh Network Operators Group
 
Chapter 3: Data and Computer Communication
Chapter 3: Data and Computer CommunicationChapter 3: Data and Computer Communication
Chapter 3: Data and Computer Communication
HabtamuAbuneAbune
 
The Internet Service Providers and Connectivity Providers of ICANN
The Internet Service Providers and Connectivity Providers of ICANNThe Internet Service Providers and Connectivity Providers of ICANN
The Internet Service Providers and Connectivity Providers of ICANN
Bangladesh Network Operators Group
 
Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...
Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...
Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...
Bangladesh Network Operators Group
 
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
Bangladesh Network Operators Group
 
DATA COMMUNICATION components, modes of transmission & communication devices ...
DATA COMMUNICATION components, modes of transmission & communication devices ...DATA COMMUNICATION components, modes of transmission & communication devices ...
DATA COMMUNICATION components, modes of transmission & communication devices ...
samina khan
 
Network Efficiency:The LLM Advantage on network infrastructures
Network Efficiency:The LLM Advantage on network infrastructuresNetwork Efficiency:The LLM Advantage on network infrastructures
Network Efficiency:The LLM Advantage on network infrastructures
Bangladesh Network Operators Group
 
Bsjsudhjsidudjdudjdudidjjdjdkdel-se-br.ppt
Bsjsudhjsidudjdudjdudidjjdjdkdel-se-br.pptBsjsudhjsidudjdudjdudidjjdjdkdel-se-br.ppt
Bsjsudhjsidudjdudjdudidjjdjdkdel-se-br.ppt
ssuserb171f7
 
Mikotik_Load_Balancing_workshop_best_practice
Mikotik_Load_Balancing_workshop_best_practiceMikotik_Load_Balancing_workshop_best_practice
Mikotik_Load_Balancing_workshop_best_practice
davidarmandorodrigue
 
Unlocking the Power of SIM Card IoT Connectivity.pdf
Unlocking the Power of SIM Card IoT Connectivity.pdfUnlocking the Power of SIM Card IoT Connectivity.pdf
Unlocking the Power of SIM Card IoT Connectivity.pdf
elite virtual staffing solutions
 
Concept and purpose of community diagnosis
Concept and purpose of community diagnosisConcept and purpose of community diagnosis
Concept and purpose of community diagnosis
felixsakwa55
 
Integration of AI and GenAI in Education and beyond
Integration of AI and GenAI in Education and beyondIntegration of AI and GenAI in Education and beyond
Integration of AI and GenAI in Education and beyond
Bangladesh Network Operators Group
 
Transport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptx
Transport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptxTransport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptx
Transport Conjjjjjjjjjjjjjjjjjjjjjjjsulting by Slidesgo.pptx
ssuser80a7e81
 
Essential Tech Stack for Effective Shopify Dropshipping Integration.pdf
Essential Tech Stack for Effective Shopify Dropshipping Integration.pdfEssential Tech Stack for Effective Shopify Dropshipping Integration.pdf
Essential Tech Stack for Effective Shopify Dropshipping Integration.pdf
CartCoders
 
Mental Health and Workplace Culture in Tech:A Personal Perspective
Mental Health and Workplace Culture in Tech:A Personal PerspectiveMental Health and Workplace Culture in Tech:A Personal Perspective
Mental Health and Workplace Culture in Tech:A Personal Perspective
Bangladesh Network Operators Group
 
Presentation About The Buttons | Selma SALTIK
Presentation About The Buttons | Selma SALTIKPresentation About The Buttons | Selma SALTIK
Presentation About The Buttons | Selma SALTIK
SELMA SALTIK
 
Fast Reroute in SR-MPLS by Md Abdullah Al Naser
Fast Reroute in SR-MPLS by Md Abdullah Al NaserFast Reroute in SR-MPLS by Md Abdullah Al Naser
Fast Reroute in SR-MPLS by Md Abdullah Al Naser
Bangladesh Network Operators Group
 
all Practical Project LAST summary note.docx
all Practical Project LAST summary note.docxall Practical Project LAST summary note.docx
all Practical Project LAST summary note.docx
seidjemal94
 
Paper: QFS: World Game (s) Great Redesign.pdf
Paper: QFS: World Game (s) Great Redesign.pdfPaper: QFS: World Game (s) Great Redesign.pdf
Paper: QFS: World Game (s) Great Redesign.pdf
Steven McGee
 
DDoS Mitigation Strategies by Md. Abdul Awal
DDoS Mitigation Strategies by Md. Abdul AwalDDoS Mitigation Strategies by Md. Abdul Awal
DDoS Mitigation Strategies by Md. Abdul Awal
Bangladesh Network Operators Group
 
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
DNS & DNSSEC operational best practices - Sleep better at night with KINDNS i...
Bangladesh Network Operators Group
 
Chapter 3: Data and Computer Communication
Chapter 3: Data and Computer CommunicationChapter 3: Data and Computer Communication
Chapter 3: Data and Computer Communication
HabtamuAbuneAbune
 
The Internet Service Providers and Connectivity Providers of ICANN
The Internet Service Providers and Connectivity Providers of ICANNThe Internet Service Providers and Connectivity Providers of ICANN
The Internet Service Providers and Connectivity Providers of ICANN
Bangladesh Network Operators Group
 
Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...
Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...
Utilizing Free and open-source Technology and Achieve Next Generation Enterpr...
Bangladesh Network Operators Group
 

Introduction of Secure Software Development Lifecycle

  • 2. AGENDA About me DAST Process in typical organizations Classical Integration of DAST in SDLC Gaps of an AppSec Program Gaps aren’t covered by SAST & DAST tools Statistics analysis of remediation cost/stages AppSec. quality improvement approach S-SDLC | Type 1 | Waterfall S-SDLC | Type 2 | Agile Comparison of all 2 approach
  • 3. ABOUT ME I am a Security professional with 13+ years of corporate experience in the field of Cyber Security, Information Security, Digital Forensics, GRC, IT Administration, Secure Software Development, Training, and company operations. I worked in various industry verticals such as Utilities, IT/ITES, E- Commerce, Government, BFSI and law-enforcement agencies. https://www.linkedin.com/in/hrishikant
  • 4. DAST PROCESS IN TYPICAL ORGANIZATIONS TIMELINES 2/3 DAYS 10/15 DAYS 1/2 DAYS 1 DAY BUT CYCLIC Understanding the scope Perform tests as per the scope Report generation and clearing the doubts Cyclic phase for re check the issues
  • 5. CLASSICAL INTEGRATION OF DAST IN SDLC Requirement Gathering Analysis Design Development Testing Deployment Maintenance DAS T Gaps in early phases *Dynamic Application Security Testing.
  • 6. RISK SOFTWARE PROJECT PROGRESS IDENTIFY CONTROL IMPLEMEN T CONTROL VALIDATE CONTROL We have jumped straight to validation without identifying the root cause and implementing the appropriate controls to reduce application security risk. GAPS OF AN APPLICATION SECURITY PROGRAM
  • 7. GAPS ARE NOT COVERED BY SAST & DAST TOOLS Source Code SAST & DAST Remediation 30% of total risks found & fixed average time to remediation = 316 days* 54% of risks found* 46% of risks are not found 70% of risks unaddressed 24% of risks found, not fixed 54% remediation rate* *Adapted from: National Institute of Standards and Technology. “Report on the Static Analysis Tool Exposition IV”. Gartner for Technical Professionals. “Application Security Think Big and Start with What Matters”. Veracode. “State of Software Security”, 2016. WhiteHat Security. “Web Applications Security Statistics Report”.
  • 8. Source Code SAST & DAST Remediation 30% of total risks found & fixed average time to remediation = 316 days* 54% of risks found* 46%of risks are not found 70% of risks unaddressed 24% of risks found, not fixed 54% remediation rate* *Adapted from: National Institute of Standards and Technology. “Report on the Static Analysis Tool Exposition IV”. Gartner for Technical Professionals. “Application Security Think Big and Start with What Matters”. Veracode. “State of Software Security”, 2016. WhiteHat Security. “Web Applications Security Statistics Report”. GAPS ARE NOT COVERED BY SAST & DAST TOOLS
  • 9. Source: Applied Software Measurement, Capers Jones, 1996 • Cost of remediation is always lesser in coding phases irrespective to number of bugs found. • Impact on services, risk delta is always increases as the SDLC phases increases. • Increase in effectiveness of controls help to decrease the number of bugs found and remediation costs. • Decrease the impact on reputation, brand, business, reliability. STATISTICS ANALYSIS OF REMEDIATION COST/STAGES “The cost of removing an application security vulnerability during the design phase ranges from 30-60 times less than if removed during production.” NIST, IBM, and Gartner Group
  • 10. APPLICATION SEC. QUALITY IMPROVEMENT APPROACH Definition Pre-Design Design Development Deployment CheckPoint 1 CheckPoint 2 CheckPoint 3 CheckPoint 4 CheckPoint 5 Concepts / Priority Selection of Controls Preliminary Design AGREEMENT Design & Review Approve Build • High Level Security Risk Analysis • Risk Base Security Plan • Selection of Controls • Selection of Service, protocols • Security Design Review • Third part assets control selection • Secure Code review • Data flow review • Vulnerability Assessment • Penetration testing • Third party assessment
  • 11. WATERFALL APPROACH FOR S-SDLC Business Requirements Application Portfolio Analysis | User Risk Analysis | Security Requirements Analysis Pre-Design Secure Design Analysis | Risk Assessment | Architecture Review Plan | Threat Modeling Design External Security Review | Design Risk Analysis | Architecture Risk Analysis Post-Design Dev. Test Plan | Review of Data Flow charts | Communication channels/Services Development Secure Code Guidelines | Static Code Analysis | Developer Training | Coding Standards Development Testing Security Metrics Development | Test Reviews | Dynamic Code Analysis | DAST Deployment Pre-Implementation Risk Management Maintenance
  • 12. AGILE APPROACH FOR S-SDLC Initial Phase Application Portfolio Analysis | User Risk Analysis | Required Training Creation User Stories Secure Design Analysis | Risk Assessment | Architecture Review Plan | Security Requirement Analysis Creation Product Backlogs Design Risk Analysis | Architecture Risk Analysis | Threat Modelling Creation Sprint Backlogs Security Metrics Development | Communication channels/Services | Secure Code Guidelines | Coding Standards Development Sprint Lifecycle Static Code Analysis | Developer Training | Dynamic Code Analysis | DAST Finishing Sprint Test Reviews | Pre-Implementation Risk Management Sprint Retrospective Feedbacks | Security Improvement Plan Maintenance
  • 13. GENERAL AGILE SDLC Client Product Owner Sprint Plan Meeting DevSecOps Team User Stories Sprint Backlog Sprint Life Cycle Product Backlog Finish of Sprint Sprint Review Sprint Retrospective Feedbacks • Product owner accept the inputs from the Client to conclude the user stories for product backlog. • Every product backlog further divided into sprint backlog as per the group of same type of functionalities. • Every Sprint backlog have the cycle of Coding and testing aligned with daily follow-up scrum meeting with scrum master, product owner, developers. • Scrum meeting is on daily basis for better analysis the growth of the project. • On the finish of Sprint, we need to review followed by Sprint retrospective for feedback to product owner likely for gaps evaluation. Security Champ.
  • 14. CI/CD APPROACH S-SDLC Continuous Delivery Continuous Integration PRO UAT QA DEV Version Control Developer 1 Developer 1Scrum Master Service Desk 1 2 3 4 5 6 7 Check 4 Changes Fetch Changes Notify issues Send Backlog
  • 15. WATERFALL | AGILE | CI/CD IN S-SDLC • Waterfall SDLC easy to alignment with Secure SDLC irrespective to Agile & CI/CD methodologies. • Waterfall model follow the consecutive process irrespective to Agile & CI/CD methodologies. • Implementation of Security in waterfall is easier then Agile & CICD but we can use some enhanced criteria for better & secure agile/CI/CD SDLCs Business Require ments Application Portfolio Analysis | User Risk Analysis | Security Requirements Analysis Pre- Design Secure Design Analysis | Risk Assessment | Architecture Review Plan | Threat Modeling Design External Security Review | Design Risk Analysis | Architecture Risk Analysis Post- Design Dev. Test Plan | Review of Data Flow charts | Communication channels/Services Develop ment Secure Code Guidelines | Static Code Analysis | Developer Training | Coding Standards Development Testing Security Metrics Development | Test Reviews | Dynamic Code Analysis | DAST Deploy ment Pre-Implementation Risk Management Secure SDLC in Waterfall Secure SDLC in Agile Secure SDLC in CI/CD * Perfectly aligned with security blocks * Hard to fit as per the security blocks Continuous Delivery Continuous Integration PRO UAT QA DEV Version Control Deve lope r 1 Deve lope r 1 S c r u m M a s t e r S e r v i c e D e s k 1 2 3 4 5 6 7 Check 4 Changes Fetch Changes Notify issues Send Backlog * Hard to fit as per the security blocks
  • 16. THANK YOU! Any questions? You can also find me at [email protected] for any further questions

Download presentation

Your download has started