Building Security In

Building Security In

1. Software Security

   • It's the idea of engineering software that it continues working correctly against malicious attacks...
     • ... vs application security
     • ... as practice by operations people
     • ... in the software development life cycle.
     • ... as a multidisciplinary effort

2. Misuse and Abuse Cases: Getting Past and th Positive

   • To create secure and reliable software, we must anticipate abnormal behavior into "misuse" or "abuse" cases into the development life cycle.
   • Every time a new requirement, case, or feature is created, that why professionals shloud play an active role in this kind of analysis.

3. Risk Analysis in Software Design

   • Risk analysis is only a business-level-decision-support tool based on knowledge about:
     • Vulnerabilities
     • Risk
     • Threats
     • Impact
   • Putting the right people together for an analysis is important, this way we combine experienced and knowledge

4. Software Security Testing

   • Identifying risks in the system and creating tests driven by those risks, a software security tester can properly focus on areas of code in which an attack is likely to succeed.
   • How and who should security testing be done?
     • It could be done by standard testing organizations using a traditional approach.
     • White-box and Black-box are methods which can reveal possible software risks and potential exploits, but the problem here is the lack of them.

5. Static Analysis for Security

   • Static analysis tools examine the text of a program statically, without attempting to execute it. Theoretically, they can examine either a program’s source code or a compiled form
     • These tools can't solve all your security problems, they look for a fixed set of patterns, or rules, in the code, although more advanced tools allow to add new rules
     • Despite these tools, the results still require human evaluation

6. Software Penetration Testing

   • Penetration testing is the most frequently and commonly applied for software security best practices.
   • It's part of the final acceptance regimen after an application is finished.
   • Penetration testing can be effective, as long as the activities are based on discover and track to the beginning of the software lifecylce.

7. Knowledge for Software Security

   • Security knowledge can be applied at various stage of the SDLC like:
     • Principles
     • Guidelines
     • Historical Risks
     • Attack Patterns
     • Rules
     • Exploits
     • Vulnerabilities

8. Adopting a Software Security Improvement Program

   • Softwares security initiatives have proven beneficial for those who implement them. A roadmap should take into consideration:
     • A tailored plan
     • Roll out individual best-practices initiatives carefully
     • Train people
     • Establish metrics
     • Establish a continuous improvement capability

9. A Portal Software Security

   • The lack of an easily accessible common body of knowledge is one of the real challenges software security faces.