Instructor: Software Development Life Cycle. 2 2
In this lesson, we are going to talk 3 3
about the software development lifecycle 4 4
and how important it is to start embedding 5 5
your security in from the beginning. 6 6
Now when I talk about the Software Development Life Cycle 7 7
or SDLC, this is talking about the process 8 8
of planning, analysis, design, implementation 9 9
and maintenance that governs software 10 10
and systems development. 11 11
Now as you start building your software, it is important 12 12
to think about security all the way from the beginning. 13 13
And if you make sure that you integrate security controls 14 14
into each stage of the SDLC, 15 15
it will save you a lot of time and money. 16 16
Now, there's really two ways to do software development. 17 17
We have the more traditional method known as Waterfall 18 18
and then the newer method known as Agile. 19 19
In this lesson, we're going to talk about both of these. 20 20
Now when we start out we want to talk 21 21
about the traditional method, which is Waterfall. 22 22
The Waterfall method is a software development model 23 23
where the phases of the SDLC cascade downward 24 24
so that each phase will start only 25 25
when all of the tasks identified 26 26
in the previous phase were already completed. 27 27
This means we're going to do all of the planning then all 28 28
of the requirements, then all of the design, then all 29 29
of the implementation, then all of the verification. 30 30
And then all of the testing and all of the maintenance 31 31
and eventually all of the retirement. 32 32
And that's one version of one piece of software. 33 33
And so all these things cascade downward 34 34
as we go through this life cycle. 35 35
Now when you're dealing with Waterfall, 36 36
there are a lot of benefits to it. 37 37
This is the way people have been doing software 38 38
and projects for decades. 39 39
Now the big problem we have with it is 40 40
that when you have an idea for something. 41 41
And you start creating the plan and the requirements 42 42
and then go all the way through the stage, 43 43
this can take a long time. 44 44
Anywhere from 6 months, 12 months, 45 45
sometimes two or three years. 46 46
And so if I wanted to develop a brand new piece 47 47
of software and I'm going to put all this money into it. 48 48
And do all this development and then not see anything out 49 49
the other side to deliver to my customer until two 50 50
or three years, that's a really long development cycle. 51 51
And if when I get it to my customer, 52 52
they find something wrong with it 53 53
I now have to go back to the beginning 54 54
and start going all the way through that cycle again. 55 55
And so this is something that gives a lot of delays. 56 56
And so if you don't do a lot of your security upfront 57 57
in your design and implementing it all the way 58 58
through these phases. 59 59
And you try to bolt on security as an afterthought, 60 60
it's going to take a long time 61 61
and you're going to have an insecure piece of software. 62 62
Now, the other way we can do things is 63 63
what's known as Agile. 64 64
The Agile method is a software development model 65 65
that focuses on iterative 66 66
and incremental development to account 67 67
for evolving requirements and expectations. 68 68
Now the nice thing about Agile is that they work 69 69
pretty quickly when you're trying to develop something. 70 70
I can have an idea for something and have something out 71 71
in the market within two weeks or four weeks. 72 72
Now it's not going to be perfect, 73 73
it's not going to be the complete program but it's something. 74 74
The whole idea with Agile is getting 75 75
something into the hands of your consumer 76 76
and getting it out there quickly. 77 77
So most of the software development you see today done 78 78
by startups is done in an Agile way. 79 79
They're going to go forward and they're going to think 80 80
of some concept, they're going to have some kind 81 81
of idea for it, they're going to start the design. 82 82
They're going to start planning 83 83
and they're going to start building. 84 84
And they're going to start testing 85 85
and they're going to do this all over 86 86
and over and over again in these quick loops. 87 87
And then they get something that's ready 88 88
and they push out the door into production. 89 89
And so we can go from idea to execution 90 90
in maybe a week or two weeks or maybe four weeks. 91 91
And we do these in these short sprints 92 92
to be able to get things out. 93 93
The whole idea when you're dealing 94 94
with Agile is getting that product 95 95
into the hands of the consumer. 96 96
And so let's use an example of this course. 97 97
I could do it as a Waterfall method 98 98
or I could do it as an Agile method. 99 99
If I was going to do it in a Waterfall method, I would go out 100 100
and outline every single video 101 101
that's going to be in this course. 102 102
So I say, okay, here are going to be 38 sections 103 103
and in section one I'm going to have these videos. 104 104
And in section two, I'm going to have these videos. 105 105
I'm going to have these lessons here and these quizzes here 106 106
and these practice exams here. 107 107
And I figure out all the things I want. 108 108
And then once we've all agreed to it 109 109
that becomes set in stone. 110 110
That's what we're going to do. 111 111
Then we start writing the lessons and filming 112 112
the lessons and building the quizzes. 113 113
And once we get all of those together 114 114
we take all of that, we bundle it up, we package it up 115 115
and we sell it to our customers. 116 116
Agile method. 117 117
This is the way traditional book authors work 118 118
because when you print a book 119 119
you can't go back and add more pages later. 120 120
But because this course is digital 121 121
I don't have to do it in that Waterfall method. 122 122
Instead, I might do it in a more Agile way. 123 123
Maybe I would say this, hey customers, 124 124
I'm going to make a brand new course. 125 125
It's on CySA+. 126 126
If you want to get into it, you're going to pay up front. 127 127
And every week I'm going to give you some more content. 128 128
And so what can happen is you sign up for the course today 129 129
and this week you're already getting 130 130
the first two hours of the course. 131 131
Next week you get another two hours of the course. 132 132
The next week you get another two hours of the course 133 133
and we'll keep doing that until you get 134 134
the entire course that you needed. 135 135
That'd be more Agile way for me 136 136
to deliver this kind of material. 137 137
Now either way you can do this 138 138
and both of them are acceptable ways of doing things. 139 139
But it depends on what is going to be best 140 140
for your customers and for your consumers. 141 141
Now in the digital world when we're dealing with products 142 142
and software, it works a lot better to do things Agilely. 143 143
Because if I start giving you this course 144 144
and the first week I get feedback from you, it says, 145 145
"Hey, I don't like the way you do these videos." 146 146
I can actually change that 147 147
and I can edit it before I go into the next section. 148 148
And so we get more feedback, more iterations 149 149
and any bugs we find can be fixed even quicker. 150 150
Instead of waiting for us to do six full months 151 151
of development of writing and filming this thing, 152 152
And then giving it to you and then finding there's errors 153 153
'cause then we have to go back and start all over again. 154 154
That's one of the big differences 155 155
between Waterfall and Agile. 156 156
Now as I said your security has to be integrated 157 157
into your Software Development Life Cycle. 158 158
And there's a couple of different ways you can do this. 159 159
One of the most common ways this is done is 160 160
by using security targeted frameworks. 161 161
They can incorporate threat and vulnerability 162 162
and risk related controls 163 163
into the software development lifecycle. 164 164
So as we're thinking about the requirements 165 165
and the plans and the designs and the implementation, 166 166
we want to integrate the security all the way through. 167 167
And so security target frameworks can help us with that. 168 168
Now in your textbook they mentioned two types 169 169
of security targeted frameworks. 170 170
The first is SDL, which is a security development lifecycle. 171 171
Now SDL is Microsoft's security framework 172 172
for application development 173 173
that supports dynamic development processes. 174 174
And so they work in an Agile way 175 175
and this is a way to implement security 176 176
throughout that Agile process. 177 177
Now another good one that's out there is OWASP. 178 178
Now OWASP is the Open Web Application Security Project 179 179
and they have their software security assurance process. 180 180
This is their security framework 181 181
for secure application development. 182 182
Now if you're not familiar with OWASP, 183 183
you can go to owasp.org. 184 184
And this is a website that is a community-funded website 185 185
and community-built website. 186 186
They are all about making sure that the best information 187 187
about coding practices is out there for the community. 188 188
So as a cybersecurity analyst, 189 189
I do recommend you take some time looking 190 190
at OWASP and looking through their various top 10 lists. 191 191
There's a lot of good information there. 192 192
Now as we go forward 193 193
and we start thinking about secure development, 194 194
I mentioned that we have to start integrating it 195 195
into each of these phases. 196 196
For example in the planning phase, we need to make sure 197 197
we're training our developers and our testers 198 198
on the different security issues that are out there. 199 199
If I start incorporating that into their training 200 200
so they understand what a buffer overflow attack is, 201 201
why input validation is important and things like that, 202 202
they can think about that as they build their software. 203 203
Then we need to think about requirements. 204 204
When we're dealing with requirements, 205 205
we have to determine the needs for security and privacy. 206 206
If I'm building an application that's going to be open 207 207
to the internet, do I need a password? 208 208
Well, maybe or maybe not. 209 209
If that application is to display my website 210 210
I probably don't need a password 211 211
'cause you just need to go to my website and read it. 212 212
But if there's a secure area of my website 213 213
then I need to have that security put in place. 214 214
So you have to give me a user and password 215 215
to access that part of the site. 216 216
The next stage we have to think about is design. 217 217
And with design we have to identify the different threats 218 218
and controls that we're going to use when we design 219 219
and start coding this software. 220 220
Then this brings us to our next stage, 221 221
which is implementation. 222 222
When we're doing implementation, 223 223
we want to make sure we're doing source code analysis 224 224
so we understand what's being written and how it works. 225 225
Then we're going to go into testing 226 226
and here's where we want to start performing 227 227
a known environment or partially known environment testing. 228 228
And start testing the system for vulnerabilities 229 229
to see if people can break our software. 230 230
Because if they can break into our software 231 231
that means we need to fix that and go back into design 232 232
and implementation to fix those coding errors. 233 233
And then we have deployment. 234 234
This is where we're going to take the software 235 235
and we're going to put it out into the environment. 236 236
We're going to install it on a server, we're going to install it 237 237
on a client and we're going to make sure it works properly. 238 238
Now here's where we're going to be focused 239 239
on the installer packages and the different best practices 240 240
of how you should configure it. 241 241
And then finally, we have maintenance. 242 242
We have to have ongoing security monitoring and maintenance. 243 243
So we put out this software. 244 244
We think it's the best thing ever 245 245
but then there's a vulnerability that's found. 246 246
What does that mean? 247 247
Well, we have to do maintenance. 248 248
Somebody has to code a patch. 249 249
We need to test that patch. 250 250
We need to deploy that patch 251 251
and then maintain the ongoing operations again. 252 252
This is how we can make sure 253 253
our security controls are all in place. 254 254
Now I mentioned testing and when we talk about testing 255 255
I want you to think about the fact 256 256
that there are three types of testing. 257 257
We have unknown environment testing, 258 258
known environment testing 259 259
and partially known environment testing. 260 260
Now I talk about unknown environment testing. 261 261
This is also known as blind testing. 262 262
This is when a cybersecurity analyst receives 263 263
no privileged information about the software. 264 264
So if I give you a binary from say Microsoft Windows 265 265
and I say, go ahead and test this, 266 266
that is unknown environment testing. 267 267
You don't have the source code, 268 268
you don't have any permissions. 269 269
You don't know anything about it. 270 270
You just know this is a binary and you need to test it. 271 271
And so you can run different tests 272 272
against it and see what you can find. 273 273
Now on the other hand, if I was writing my own code 274 274
I might have you do known environment testing. 275 275
If I'm doing known environment testing, 276 276
this is also known as full disclosure testing. 277 277
This is where a cybersecurity analyst receives 278 278
privileged information about the software. 279 279
So you might get things 280 280
like the source code and credentials. 281 281
So I could say, "Hey, I built this new app 282 282
for my website to test my students. 283 283
Can you go ahead and test it?" 284 284
Here's the source code and you can look at it line by line 285 285
and know exactly what it's doing. 286 286
And then you can put it through dynamic testing as well. 287 287
Now the other kind we have is what's known 288 288
as partially known environment testing. 289 289
And this is kind of a in between place. 290 290
This is where a cybersecurity analyst is going to receive 291 291
partial disclosure of information about the software. 292 292
I may not give you the entire source code 293 293
but I might give you some information and say, 294 294
this is what the thing is supposed to do. 295 295
Here's the inputs it takes, 296 296
here's the outputs you should expect. 297 297
Here is a standard user account 298 298
that you can use going against this software 299 299
and then you can do your testing with that. 300 300
It's not fully blind but it's not fully disclosed. 301 301
So that's why we call it 302 302
partially known environment testing. 303 303
It's between the unknown and known testing. 304 304
Next, let's talk about some secure coding best practices 305 305
because secure coding can make your software more secure. 306 306
And save your organization even more money. 307 307
Because when you're putting on security as an afterthought, 308 308
it's actually much more expensive 309 309
than building your programs 310 310
with security from the beginning. 311 311
Now to do this, you want to make sure 312 312
you're using secure coding. 313 313
And there's some best practices you should be aware of. 314 314
So when it comes to secure coding best practices, 315 315
there's really two organizations that I like to think of. 316 316
The first is OWASP and the second is SANS. 317 317
When we talk about O-W-A-S-P or OWASP, 318 318
this is the open web application security project. 319 319
And it's a charity and community that publishes 320 320
a number of secure application development resources. 321 321
When we talk about SANS, 322 322
this is a System Admin, Network and Security Institute. 323 323
This is a company that specializes in cybersecurity 324 324
and secure web application development training. 325 325
And it also sponsors the GIAC certification, 326 326
the Global Information Assurance Certification. 327 327
Now for the exam, let me give you a quick tip. 328 328
It is worth your time to go to owasp.org, OWASP website. 329 329
And I want you to go there 330 330
and look at their various top 10 lists. 331 331
When you go through those, you're going to see a lot 332 332
of things that we cover in this course. 333 333
They're going to talk about SQL injections 334 334
and XML injections and buffer overflows 335 335
and race conditions and all of those type of things. 336 336
And for each of those they're going to have articles 337 337
that gives you examples of them, 338 338
including in detail for the source code. 339 339
Now CompTIA loves the poll questions 340 340
for the CYSA+ and the PenTest+ exams from OWASP. 341 341
Why, because it is a great resource 342 342
and it is the most common 10 vulnerabilities 343 343
that you'll find for any particular topic. 344 344
So do spend some time looking through those. 345 345
When I write my practice exams I go into OWASP 346 346
and I actually pull out things from the top 10. 347 347
Why, because so does CompTIA 348 348
and so this is a great place 349 349
for you to get some information. 350 350
And in the real world, it's a great place to learn some 351 351
of these security coding techniques to make sure 352 352
that you're doing software development 353 353
the right way from the beginning.