Effective Software Security Management

Few excerpts from my white paper on 'Effective Software Security Management'

If you wonder “What makes secure software different?” you would realize that security is an innate property of the software which was expected to be built in. Unfortunately, most of applications lack security today. The traditional practices used to develop outsourced applications are no more effective. Even the Indian IT services companies lag in improvising their SDLC at the same pace with the global industry. One of the weakest areas where these companies fall is Software Security. Current business environment is fraught with risks. The applications demand tight software security embedded inside to prevent hackers getting in. To incorporate software security measures, enterprises need to change their existing application development lifecycle.

The current scenario is such that many companies to an extent have started addressing security earlier in the lifecycle to mitigate the risks of application security attacks. But, there is still room for improvement. The application security landscape is changing rapidly.

Customers outsourcing applications need to ensure the application development lifecycle of the IT services provider embark software security inline. The IT services companies on the other hand need to develop confidence in the customer for software security levels in their SDLC.

Maintaining a high level of security is no simple proposition. One of the key issues with outsourced applications is that unlike functional concerns, non-functional concerns of application like security and performance are always given lower priority. If the services companies fail to understand the importance of these non-functional factors, the customer is at loss. At the end, if these security defects are injected due to lack of measures taken during SDLC, it may destroy customer value and trust.

Growing Demand of Moving Security Higher in SDLC

Application Security has emerged as a key component in overall enterprise defense strategy. Companies that build a strong line of defense usually learn to think like an attacker. Often is a developer is asked to wear two hats: one as developer that works in complex distributed environments, and the other as a security expert who builds software security. Organizations that understand application security practices and priorities are using resources far more effectively than in years past, while avoiding costly and potentially crippling problems.

In the years past, anti-virus software, firewalls, intrusion detection and intrusion prevention systems have been successful enough to protect network and hosts. While still the bulk of attacks happen at network layer, attackers have been successful compromising the application with lower ratio of making applications as targets. The industry reports of organization suffering application attacks with significant downtime in the application or loss of customer data. Financial institutions, Healthcare providers, Retailers, Telecom Industry or even IT Companies have not been able to get escaped from becoming a victim of application attacks. The impact of these attacks have been damage to their brand name, loss in revenue, loss of customer data, system or network downtime and even legal issues with compliance to PCI (Payment Card Industry) or SOX (Sarbanes-Oxley) standards.

In the current world, software security assurance needs to be addressed holistically and systematically in the same way as quality and safety. Most of the assurance can be driven by improved software development practices. It is also important to realize that the security cost factor increases as you move down the SDLC.