Thursday, 21 April 2016

Ten Best Practices for Secure Software Development Part 1 software companies in india

The Need for Secure Software, Software Assurance for software companies in india: A Kaleidoscope of Perspectives, and Software Security: Being Secure in an Insecure World, address the “Why”, “What” and “How-Tos” of designing, developing, and deploying secure software. This whitepaper focuses on the human element – the “Who” and will center around “The Ten Best Practices” that a secure software lifecycle professional should follow to build secure, hack-resilient, and compliant software.

The Ten Best Practice

  1. Protect the Brand  Your Customers Trust
  2. Know Your Business and Support it with Secure Solutions
  3. Understand the Technology of the Software
  4. Ensure Compliance to Governance, Regulations, and Privacy
  5. Know the Basic Tenets of Software Security
  6. Ensure the Protection of Sensitive Information
  7. Design Software with Secure Features
  8. Develop Software with Secure Features
  9. Deploy Software with Secure Features
  10. Educate Yourself and Others on How to Build Secure Software

Best Practice #1: Protect the Brand Your Customers Trust

The Harvard Business Review special publication, “Breakthrough Ideas for 2008,”b listed “Cybercrime Service Economy” as one of the top 20 transformations of the business world for software companies india. Scott Berinato, Executive editor of CSO magazine, who contributed to the publication, asserts that the new breed of hackers don’t just cause interruptions to a business, but threaten it by undermining commercial confidence and customer trust. His conclusion is noteworthy; in the event of cybercrimes, victims will look for someone to be held responsible, and it will not be the hackers but the brands that the victims trusted to protect them.

Best Practice #2: Know  Your Business and Support it with Secure Solutions

Most skilled security professionals agree that, along with a strong background in technology, a thorough understanding of the business is of paramount importance when it comes to creating secure solutions for that business. Though some purist security technologists may find it difficult to accept, it is nevertheless true that security is there for the business and not the other way around. Security exists to enable the business, not to be an impediment. The answer to the question, “Why were brakes invented?” could be answered in two ways: to prevent the vehicle from an accident, or to allow the vehicle to go faster. Security is similar; it can prevent the business from a crash, or allow the business to go faster.

Best Practice #3: Understand the Technology  of the Software

Not only is it critical to know the business, but one must have a strong background in technology to be effective in building or buying secure software fpr software companies in india . A lack of understanding of the technology used to build or buy software can lead to insecure implementations of the software. When it comes to building the software in-house, a thorough understanding of the existing infrastructural components, such as network segregation, hardened hosts, and public key infrastructure, is necessary to ensure that the deployment of the software will, first, be operationally functional and, second, not weaken the security of the existing environment. In other words, understanding the interplay of your current technological components with the software you build and/or deploy will help determine the impact on overall security. Further, understanding the technology used in building software can help towards making decisions that favor security. As an example, knowing that managed code (.Net and Java) have less likelihood of memory corruption and thus are less susceptible to overflow attacks than unmanaged code (C/C++), would help in choosing newer-generation managed code as part of the coding standard to develop software.

Best Practice #4: Ensure Compliance to Governance, Regulations, and Privacy

In this day and age, an industry that is not regulated is more the exception than the norm as opposed to just a few years ago when the industry that was regulated was the exception for software companies india.  The increase in regulatory and privacy requirements imposes a serious burden on organizations. Governance, Risk, and Compliance (GRC) is not just an industry buzz phrase, but a reality and a means toward meeting regulatory and privacy requirements. As a SSLP, one must understand the internal and external policies that govern the business, its mapping to necessary security controls, the residual risk from post implementation of security controls in the software, and the evergreen aspects of compliance to regulations and privacy requirements

Courtesy: Sanika Taori

No comments:

Post a Comment