A Survey on Secure Software Development Lifecycles

Software Development And Security

One important metric of software quality is assurance: “a level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its lifecycle, and that the software functions in the intended manner” (CNSS Secretariat, 2006). To achieve software assurance developers need to build assured software: “Software that has been designed, developed, analyzed and tested using processes, tools, and techniques that establish a level of confidence in its trustworthiness appropriate for its intended use” (CNSS Secretariat, 2006). To achieve this goal, developers must rethink the software development process and address all the phases of the SDL: design, code and documentation (Howard & LeBlanc, 2003). This is like applying the defense-in-depth strategy to the various phases of the software development lifecycle making it more security aware.