Premium Essay

Build a Web Applications and Security Development Life Cycle Plan

In:

Submitted By panamario86
Words 2006
Pages 9
Build a Web Applications and Security Development Life Cycle Plan
What are the elements of a successful SDL?
The elements of a successful SDL include a central group within the company (or software development organization) that drives the development and evolution of security best practices and process improvements, serves as a source of expertise for the organization as a whole, and performs a review (the Final Security Review or FSR) before software is released.
What are the activities that occur within each phase?
Training Phase- Core Security Training
Requirements Phase- Establish security requirements, create Quality Gates/Bug Bars, perform Privacy Risk assesments.
Design Phase-Establish Design Requirements, perform Attack Surface Analysis/Reduction, use Threat Modeling
Implementation Phase- Use approved tools, Deprecate unsafe functions perform static analysis
Verification Phase- Perform Dynamic Analysis, Perform Fuzz Testing, Conduct Attack Surface Review
Release Phase- Create an incident Response Plan, Conduct Final Security Review, Certify release and archive
Response Phase- Execute Incident Response Plan
Phase Activities Roles Tools
Requirements - Establish Security Requirements
-Create Quality Gates/Bug Bars
-Perform Security and Privacy Risk Assessments -Project Managers
-Security Analysts -Microsoft SDL Process Template for Visual Studio Team System
- MSF-Agile + SDL Process Template
Design -Establish Design Requirements
-Perform Attack Surface Analysis/Reduction
-Use Threat Modeling -Project Managers
-Tester
-Software Developers
-Security Analysts
-QA -Microsoft Threat Modeling Tool 2014
Implementation -Use Approved Tools
-Deprecate Unsafe Functions
-Perform Static Analysis -Software Developers
-Tester
-Security Analysts
-QA -SDL Tools
-Banned.h
-Anti-XSS Library
-FxCop
-Code Analysis for C/C++
-CAT.NET 32-bit

Similar Documents

Premium Essay

Cloud Computhing

...(SaaS): 4 Platform as a Service (PaaS): 5 Infrastructure as a Service (IaaS): 5 Deployment Model of cloud computing 5 Public Cloud: 5 Private Cloud: 6 Community Cloud: 6 Hybrid Cloud: 6 Challenges of cloud computing 7 Benefits 7 Implementation Plan 9 How Does Data Stay Safe in the Cloud? 9 Are your applications ready to run on cloud? 9 Will you able to receive customer support for the service? 10 Client considerations for Best Practices during Implementation and Deployment 10 Implementation Strategy 10 Cloud architecture: 10 Market Analysis 11 Important Questions to be address by management 11 Implementation Cycle 12 References (Author, Year) 14 Cloud computing Introduction Whenever technology changed or company move to new business plan, it costs them and many of these companies cannot afford in current economic environment. And most of the time all the investments are not useful at the same time. They wish to “pay for what they use” services and use their efforts and money in main business to add value to it. So these challenges and expectations cause the born of cloud computing.Cloud Computing provides a simple, economicaland efficient way to access servers, storage, databases and a broad set of application services over the Internet.Organizations may increase business concentration which means that companies can focus on their core business and outsource their technology and IT infrastructure to the cloud provider. Thomson Reuters and Aflac Inc and many...

Words: 3580 - Pages: 15

Premium Essay

Is308 Project

...UNFO Security White Paper Information Security Analyst Executive Summary Date: Friday, September 06, 2013 Introduction Since UNFO’s customer base will have the ability to call in by using credit card numbers to make online purchases with an expectation of 6,000,000 transactions, the need for a well thought out framework plan is essential. The conversations will be recorded and stored in the organization's Private Branch Exchange (PBX) system to where data storage hardware and software requirements will be needed. This document is to outline a Web security life cycle for the organization that will later be compiled as part of the organization's overall security policy by the organization's Senior Security Engineer. Therefore the following categories will serve as the staple of this outline: Application development, QA/testing, deployments, website encryption/key management, data storage/access, systems/devices that interact with the website, 3rd party vendor access, employee web security training, regulatory compliance, emerging laws and regulations for website security. 1. Application development : a. System Analysis: i. Define clearly of the purpose of the software ii. Provide direction for further development iii. Refine project goals for clear function and intended application b. Design: iv. Application’s features and operational functions v. Documentation of application vi. Visualization...

Words: 1842 - Pages: 8

Premium Essay

Securing Information

...to the security requirements of your information system? From the very earliest stages of planning for the development of the system to its final disposal is the advice of the National Institute of Standards and Technology (NIST).  By considering security early in the information system development life cycle (SDLC), you may be able to avoid higher costs later on and develop a more secure system from the start.  The System Development Life Cycle (SDLC) The system development life cycle starts with the initiation of the system planning process, and continues through system acquisition and development, implementation, operations and maintenance, and ends with disposition of the system. Specific decisions about security must be made in each of these phases to assure that the system is secure.   The organization develops its initial definition of the problem that could be solved through automation.   Also during this early phase, the organization starts to define the security requirements for the planned system. Management approval of decisions reached is important at this stage.  During this initiation phase, the organization establishes the security categorization and conducts a preliminary risk assessment for the planned information system.  Categorization of the information system using federal standards and guidelines aids system security planners in defining information system security according to levels of impact, and in selecting a baseline of initial security controls...

Words: 1328 - Pages: 6

Free Essay

Web Migration4

...technology field and all things related to the internet are in a constant state of improvement. Due to the high need to be able to compete in any online market successfully a company needs to be able to keep a secure, working website with an uptime as close to 100% as possible. With the very real possibility of malicious crackers trying to do damage or steal data security is of the utmost importance. One of the best ways to improve security and control is for the company to host their own website internally. The benefit’s for doing this transition will be well worth the effort but there are few points that need to be considered before making the final decision. The goal of this report is to provide information and a guide to the process of creating a secure e-commerce site with minimum downtime. Considerations: There are a few factors that need to be considered before making the move to migrate the website. * Cost-Hardware, labor, software, etc. * Security-physical and physical * Physical space- structure, square footage, additional offices etc. Solution Using the System Development Life cycle we can define an efficient way to meet our set requirements and improve the existing website. Improving on the old foundation we can minimize costs, reduce project time and save the labor costs of having to start from scratch. This way we can focus on only redesigning parts we can’t recycle and improve on what we need to. Goals of the SDLC: * Deliver quality...

Words: 1721 - Pages: 7

Free Essay

Cis 210 Term Paper

...options. The new website plan is for it to be redesigned to allow for online ordering, onsite web hosting, and site redundancy to allow for maximum uptime. What they are asking for is called the system development life cycle (SDLC). Systems development life cycle is defined as "activities and functions that systems developers typically perform, regardless of how those activities and services fit a particular methodology” (Shelly & Rosenblatt, 2011). The systems development life cycle contains the following steps in the model: required analysis, testing, implementation, documentation, deployment, and maintenance. Discuss what it will take to build a Web architecture, move an existing Website with minimal downtime, and provide a disaster recovery solution to ensure the site is always available. The new web architecture is a complete change from the previous implementation of the site causing an entirely new template and architecture. Previous setup used manual ordering, so they would have to call in or physically come in to order the chips. The new architecture will allow for online ordering that will free up more user time in answering phones taking orders. I am assuming the previous network architecture is up to date and running properly. With this assumption, few technology upgrades will be fully required. Improving the technology infrastructure would require an upgraded internet connection to help offset the new traffic that will be occurring with the web site being hosted locally...

Words: 2926 - Pages: 12

Premium Essay

A Technical View of System Analysis and Design

...A Technical View of System Analysis and Design Abstract System Analysis and Design is a process. Analysis is the part that involves the study of the units working together. Design is an essential phase in the development process based on the user needs. System Analysis and Design is an approach towards reinforcing the analysis and design of information systems with the objective of improving the system performance by automation. This paper explores the Managers outlook and importance of System Analysis and Design as well as the exploration into organizations that utilize System Development and Design. We uphold that continual and extensive use of current System Analysis and Design Methodologies will assist in the development of an effective system. Key Words: System Analysis, System Design, Methodologies Introduction Computers are now becoming part of virtually every activity in an organization. This paper explores the relationship between the organizations and managers of IS projects and the usefulness and need for IS project managers to become more knowledgeable to be able to effectively anticipate and deal with conflicts that arise as a consequence of information systems creation or modifications in organizations. The development of a system basically involves two major parts: System Analysis and System Design. System Analysis is defined as the study of a business problem domain or area to recommend improvements and specify the business requirements...

Words: 4173 - Pages: 17

Premium Essay

Club It 3

...header: Club IT Part Three 2 Lisa and Ruben are the club owners. In our initial meeting we discussed what was expected of the job that was being undertaken. They explained to me a little about the club and an overview of their need to boost their information technology, data management, and decision-making capabilities. “To learn more about Club IT’s operations, we stayed until the 2:00 a.m. closing this morning to see how everything was tallied and accounted at the end of a business day. Although it was a late night and we had to wake up early this morning to report back to work, we now have a better understanding of the daily business cycle at Club IT. Lisa asked me for suggestions on how to use club and public resources to keep Club IT’s edge as the high-energy, high-impact club it strives to be”.(Wiley, 2009) “Lisa and Ruben have just completed extensive remodeling of the interior of Club IT and are pleased with the results. The club’s tall ceilings and high-energy lighting creates an ambience of fun and liveliness. They hire live bands on Fridays and Saturdays and have a live DJ Tuesdays through Thursdays; the club is closed on Sundays. The DJ uses a collection of MP3 playlists, including hip-hop, techno, and electronic with some Top 40s thrown in.”(Wiley,...

Words: 1875 - Pages: 8

Premium Essay

Library Mgt System

...EBONYI STATE UNIVERSITY ABAKALIKI TITLE INTEGRATED LIBRARY MANAGEMENT SYSTEM BY NAME: REG_NO: LEVEL: DEPARTMENT: TO: DR. MRS ALO DATE: 7TH MAY, 2013 DEDICATION This work is solely dedicated to God almighty. ACKNOWLEDGMENT I want to appreciate my friends and family members for their support all through the incubation period of this project. As you stood by me so shall God stand by you all, whenever and wherever. Thank you all. Table of Contents DEDICATION 2 ACKNOWLEDGMENT 3 ABSTRACT 6 CHAPTER ONE 7 INTRODUCTION 7 1.1 BACKGROUNG OF STUDY 7 1.2 PROBLEM STATEMENT 7 1.3 AIM AND OBJECTIVES 8 1.3 SIGNIFICANCE OF STUDY 8 1.5 SCOPE OF STUDY 8 CHAPTER TWO 9 LITERATURE REVIEW 9 2.1 Aspects of Next-Generation ILS 10 CHAPTER THREE 13 METHODODLOGY AND SYSTEM ANALYSIS 13 3.1 RESEARCH METHODOLOGY 13 3.1.1 Project Methodology 13 3.3 DATA ANALYSIS 15 3.3.1 LIMITATIONS OF THE EXISTING SYSTEM 15 3.3.2 DATA FLOW OF THE PROPOSED SYSTEM 16 3.5 SYSTEM SPECIFICATION 17 CHAPTER FOUR 18 SYSTEM DESIGN 18 4.1 INPUT AND OUTPUT FORMS 18 4.1.1 DATA TABLES 18 4.1.2 DISPLAY FORMS 19 4.2 CONCLUSION 21 REFERENCES 22 ABSTRACT The adoption of integrated library systems (ILS) became prevalent in the 1980s and 1990s as libraries began or continued to automate their processes. These systems enabled library staff to work, in many cases, more efficiently than they had in the past. However, these systems were also restrictive—especially as the nature of the work...

Words: 4154 - Pages: 17

Premium Essay

Web Application Attack Scenario

...Assignment 1: Web Application Attack Scenario (Student’s Name) (Professor’s Name) (Course Title) (Date of Submission) Introduction Web applications are nowadays serving as a company’s public face to the internet. This has created the need to identify threats and attacks directed to data servers and web applications. Hackers exploit vulnerabilities in input validation and authentication affecting the web application in order to gain illegal access and disclose sensitive data or manipulate it to their benefits. Common threats to data systems Data systems such as the web application and data servers are faced by a number of threats, some of these threats are discussed below: Spoofing: this is a situation where computer assume the identity of another and masquerading where a user assumes to be another (Cross, 2007). If the attacker manages to get high privileges, he can use this to attack the web system to insert or change the data, denial of service, or even damage the system. Scavenging: This is a threat presented by examining available data form accessible sources such as waste, network and search engines. Scavenging might identify the actual information needed by the hacker but in most cases, it is used as a way to select other threats for vulnerabilities that are well established for web systems attack. The information gathered through scavenging include, server software, type of operating system firewall and the application software. This risk highly lies at the client...

Words: 1087 - Pages: 5

Premium Essay

Directed Research Project

...Project Deliverable 6: Final Project Plan CIS 590 Directed Research Project 6/15/15 Table of Contents 1. Project Plan Overview 1.1 Background 1.2 Project Description 1.3 Goals and Objectives 1.4 Scope 1.5 Roles and Responsibilities 1.6 Constraints and Assumptions 1.7 Risks 1.8 Project Deliverables 2. Project Work Plan 2.1 Work Breakdown Structure 2.2 Staffing Plan 2.3 Project Schedule 2.4 Project Budget 3. Solution Provider 4. Database and Data warehousing 5. Infrastructure and Security 6. Appendix The Project Plan defines the following: 0 Background 1 Project Description 2 Business and project goals and objectives 3 Scope 4 Roles and responsibilities 5 Assumptions and constraints 6 Project budget 7 Project timeline 8 The conceptual design of new technology 1. Project Plan Overview 1.1 Background Information is a significant component of any trusted business activity. Information is useful across the entire organization for number of purposes and is stored in an assortment of information systems. Modification to any of these information systems must be firmly controlled and managed to evade those loss of important information that cannot be recovered. System...

Words: 4434 - Pages: 18

Free Essay

Final Project Report

...Final Project Report for Media Tracking System Version 2.0 approved [pic] Table of Contents Table of Contents i Revision History iii Group Members iii 1. Final Project Summary i 1.1. Content Summary i 1.2. Lessons Learned ii 1.3. Learning Outcomes Summary ii 1.3.1 Communications iii 1.3.2 Critical Thinking v 1.3.3 Network Design v 1.3.4 Management Information Systems v 1.3.5 Systems Administration and Scripting vi 1.3.6 Security vi 1.3.7 Employability vi 2. Future directions vii 3. Annotated Bibliography viii 4. Appendix A: Vision and Scope viii 5. Appendix B: Status Report 1 15 6. Appendix D: Presentation Slides 27 7. Appendix E: Other Deliverables/Artifacts 27 Revision History |Name |Date |Reason For Changes |Version | |Kenneth Wright |07/01/2010 |Initial Draft |1.0 | |Kenneth Wright, et al |07/15/2010 |With contributions and edits from all team members, we |1.5 | | | |refined the document | | |Kenneth Wright, et al |07/23/2010 |Style, editing, additional information from all team |1.6 ...

Words: 3643 - Pages: 15

Premium Essay

Development of an E-Commerce Website for Abc Corporation

...Development of an E-Commerce Website for ABC Corporation Tammy Semelsberger Managerial Applications of Information Technology – IS535 DeVry University, Keller Graduate School of Management August 18, 2012 Table of Contents Abstract 3 Company Background 3 Business Problems 4 High-Level Solution 5 Benefits of Solving the Problem 6 Business/Technical Approach 7 Business Process Changes 7 Technology / Business Practices Used to Augment Solutions 9 Conclusions and Overall Recommendations 10 High-level Implementation Plan 10 Summary 11 Summary of Recommendations 11 References 13 Development of an E-Commerce Website for ABC Corporation Abstract ABC Corporation (ABC) is a clothing store in Chicago, IL. They are a local store that needs to increase profitability and competitiveness. Designing a custom e-commerce online store on their current website, that is tailored to ABC’s goals and customer needs, is key in attracting and maintaining a customer base, and increasing profitability. The business problem to be solved is how to implement, market, and maintain a successful e-commerce site while building customer loyalty, increasing profitability, improving strategic planning, and expanding the market. ABC will use an outside source to develop, produce and maintain this store. There will be reporting systems in place to analyze data...

Words: 2619 - Pages: 11

Premium Essay

Happy

...Fundamentals Authors Peggy Fisher (Web Development and Database Administration). Peggy teaches computer science at a rural high school in central, Pennsylvania. Indian Valley High School offers courses in programming (C#, VB, and Java for the AP course), and Web design (Expression Web, HTML, JavaScript, and CSS). Peggy worked for a large insurance company outside Philadelphia, Pennsylvania, prior to leaving the corporate world to join the field of education. She has been at IVHS for the past eight years and truly enjoys her new career. Peggy also teaches part-time at Pennsylvania State University in the Continuing Education program. Her goal in teaching is to instill the love of learning so that her students will graduate and become lifelong learners. Peggy is the co-author of the Web Development Exam Review Kit in the MTA Exam Review Kit series. Patricia Phillips (Lead Author and Project Manager). Patricia taught computer science for 20 years in Janesville, Wisconsin. She served on Microsoft’s National K-12 Faculty Advisory Board and edited the Microsoft MainFunction website for technology teachers for two years. For the past five years she has worked with Microsoft in a variety of roles related to K-12 curriculum development and pilot programs including Expression Studio web design and XNA game development. In her role as an author and editor, Patricia wrote several articles and a student workbook on topics including computer science, web design, and computational thinking. She...

Words: 11425 - Pages: 46

Free Essay

Samsung

...SAMSUNG INDIA-An Introduction Samsung India Electronics Private Limited (SIEL) is the Indian subsidiary of the US $55.2 billion Samsung Electronics Corporation (SEC) headquartered in Seoul, Korea. It is the hub of Samsung’s South West Asia Regional Operations, and looks after its business in Nepal, Bangladesh, Maldives & Bhutan besides India. SIEL commenced operations in India in December, 1995. Initially, a player only in the Colour Televisions segment, it later diversified into colour monitors (1999) and refrigerators (2003). Today, it is recognized as one of the fastest growing brands in the sphere of digital technology, and enjoys a sales turnover of over $ US 1 billion in a just a decade of operations in India. Samsung in India has a presence in the following areas of business: • • • Consumer Electronics (CE)/Audio Visual (AV) Business Home Appliances (HA) Business Information Technology (IT) Business Its operations are broadly divided into the following key sub-functions: • • • Sales & Marketing Manufacturing Software Centre Operations THE SALES & MARKETING FUNCTION Headquartered in New Delhi, Samsung India has a network of 19 branches and 16 Area Sales Offices (ASOs) located all over the country, and the number is expected to grow, as the organization continues to expand its horizons. The Sales & Marketing function at Samsung is primarily divided into two categories: • • Sales & Marketing (IT) Sales & Marketing (AV/HA) Apart from...

Words: 4641 - Pages: 19

Premium Essay

Networks

...Chapter 1 Analyzing Business Goals and Constraints This chapter serves as an introduction to the rest of the book by describing top-down network design. The first section explains how to use a systematic, top-down process when designing computer networks for your customers. Depending on your job, your customers might consist of other departments within your company, those to whom you are trying to sell products, or clients of your consulting business. After describing the methodology, this chapter focuses on the first step in top-down network design: analyzing your customer’s business goals. Business goals include the capability to run network applications to meet corporate business objectives, and the need to work within business constraints, such as budgets, limited networking personnel, and tight timeframes. This chapter also covers an important business constraint that some people call the eighth layer of the Open System Interconnection (OSI) reference model: workplace politics. To ensure the success of your network design project, you should gain an understanding of any corporate politics and policies at your customer’s site that could affect your project. The chapter concludes with a checklist to help you determine if you have addressed the business issues in a network design project. Using a Top-Down Network Design Methodology According to Albert Einstein: 000200010270745975 “The world we’ve made as a result of the level of thinking we have...

Words: 8812 - Pages: 36