CB3591 – ENGINEERING SECURE SOFTWARE SYSTEMS
UNIT I – NEED OF SOFTWARE SECURITY AND LOW-LEVEL
ATTACKS
[Detailed notes for Unit I included previously]
UNIT II – SECURE SOFTWARE DESIGN
[Detailed notes for Unit II included previously]
UNIT III – SECURITY RISK MANAGEMENT
[Detailed notes for Unit III included previously]
UNIT IV – SECURITY TESTING
[Detailed notes for Unit IV included previously]
UNIT V – SECURE PROJECT MANAGEMENT
1. Governance and Security
Governance in Software Projects: - Governance refers to the framework
of policies, processes, and controls that guide software project execution. - In
a security context, governance ensures that security is a strategic goal, not
just a technical issue.
Key Components of Security Governance: - Leadership: Executive
support for security initiatives. - Policy Frameworks: Establish rules for
secure development and maintenance. - Accountability: Define roles and
responsibilities. - Compliance: Adherence to legal and regulatory
requirements (e.g., GDPR, HIPAA).
Benefits: - Enhances organizational reputation - Reduces legal and financial
risk - Improves operational resilience
2. Adopting an Enterprise Software Security Framework
Purpose: - To integrate security across software projects at the enterprise
level.
Popular Frameworks: - OWASP Software Assurance Maturity Model
(SAMM): - Maturity model for secure software development practices. -
Covers governance, construction, verification, and deployment.
BSIMM (Building Security In Maturity Model):
o Descriptive model based on observing real-world practices.
o Considers domains like security training, SSDL touchpoints, and
penetration testing.
Microsoft Security Development Lifecycle (SDL):
o A set of practices that support secure software development
from design to deployment.
Benefits: - Repeatable and measurable security practices - Cost-effective
vulnerability mitigation - Increases security awareness across the
organization
3. Security and Project Management
Integrating Security into Project Management: - Security must be part
of the project’s scope, planning, and execution.
Activities across Project Phases: - Initiation: Define security objectives,
assign roles. - Planning: Identify threats, estimate security tasks, define
secure architecture. - Execution: Perform code reviews, secure
configuration. - Monitoring & Controlling: Conduct security testing, audits,
and compliance checks. - Closure: Final security review, documentation,
and knowledge transfer.
Project Management Tools Supporting Security: - JIRA with security
plugins - Risk management platforms (e.g., RiskWatch, Archer) - Secure
CI/CD tools (e.g., GitHub Actions + SAST)
Challenges: - Budget constraints - Skill shortages - Misalignment between
dev and security goals
4. Maturity of Practice
Definition: - Refers to the level of formalization, consistency, and
repeatability of security practices in an organization.
Security Maturity Models: - Help organizations evaluate their current
security capabilities and plan improvements.
Key Models: - CMMI (Capability Maturity Model Integration): Adapted
to assess software security processes. - OWASP SAMM Maturity Levels: -
Level 1: Initial/ad hoc - Level 2: Defined processes - Level 3: Measured and
optimized
Assessment Criteria: - Existence of security policies and controls -
Integration with SDLC - Automation and tool support - Metrics collection and
analysis
Benefits of Higher Maturity: - Lower risk exposure - Faster response to
incidents - Better compliance and audit readiness
Conclusion: Secure project management ensures that security is not an
afterthought but an integrated part of the software development process.
Through governance, frameworks, disciplined project management, and
maturity evaluation, organizations can create a strong foundation for
software security.
