We're building the future of Supply Chain Security. View Roles

02) Does your organisation have a documented and approved software development life-cycle (SDLC) process that includes security input?

August 31, 2022 Software Development Secure SDLC Software Development Lifecycle

Answer yes if your organisation has implemented a secure SDLC (Software Development Lifecycle) that includes a security risk assessment. Please describe your SDLC process in the notes, highlighting any security input, or provide a supporting document (as a PDF) as evidence.

What is it?

It’s important to follow secure development practices to avoid the introduction of vulnerabilities into software during the software development life-cycle (SDLC). This can include solution design/architecture to ensure that the overall logic in applications is well thought-out and free of loopholes or anything else that could allow an attacker to misuse or circumvent features.

Why should I have it?

Software is traditionally developed with functionality in mind. This means considering “Will the software or code perform the function I want it to?” but this approach often omits considering whether the software could be used in unintended ways to perform undesirable functions.

For example, a function in an early version of Sendmail (a service for receiving and passing on email) allowed the contents of undeliverable emails to be stored in a ”deadletter” file on the mail server for latter review. However, it turned out to be possible for attackers to create specially crafted undeliverable emails that would trick the email server to not store them in the “deadletter” file, but rather any file of the attacker’s choosing. This allowed attackers to simply email an administrative account entry for themselves into the system’s password file, which they could then use to log into the system with.

There are numerous software vulnerabilities where failure to properly validate input and limit what data could be entered into certain fields allow attackers to cause memory buffers to overflow and inject code into parts of system memory where they would then be executed.

These are all examples of where software worked correctly for its intended purpose, but insufficient consideration had been made as to how it could be misused in unintended ways.

Naturally, having secure code without vulnerabilities is essential to protecting your organisation, but it is also considered by clients who would rely on your software which could put their organisation and data at risk.

How to implement the control:

To help improve the robustness of code (which has not only security benefits but also aids in code consistency, stability, and quality), it’s important to have a well-established SDLC process.

This process should begin with appropriate secure development training for developers, strict controls around code addition and modifications, objective peer review of code where possible, and automated static and dynamic code testing. Deficiencies found should not only be solved, but used as feedback to improve the development process and developer training as applicable.

There are numerous consultancies or individual consultants that will be able to assist in crafting a policy and SDLC process that meets your business and technical requirements. Please message us if you would like a recommendation.

If you would like to contribute to this article or provide feedback, please email knowledge@riskledger.com.

Contributors will be recognised on our contributors page.

Leave a public comment

Please do not submit your answer on the knowledge base.