Abstract
From the early 1970s, the U.S. government began to recognize that simple penetration testing could not assure the security quality of products. The results of penetration testing such as identified vulnerabilities and faults can vary depending on the capabilities of the team. In other words, the penetration testing team cannot assure that “vulnerabilities are not found” is equal to “product does not have any vulnerabilities”. So the U.S. government realized that in order to improve the security quality of products, the development process itself should be managed in a strict, systematic manner. The US government began to publish various standards related to development methodology and evaluation procurement systems, embedding the “Security-by-Design” concept from the 1980s. Security-by-Design involves reducing a product’s complexity by considering security from the early phase of the development life-cycle such as during the product requirements analysis and design phase to ultimately achieve trustworthiness of the product. Since then, the Security-by-Design concept has spread to the private sector, since 2002 this has often come in the form of Secure SDLC by Microsoft and IBM, this system is currently being used in various fields such as automotive and advanced weapon systems. However, the problem is that it is not easy to implement in the field because the standards or guidelines related to Secure SDLC contain only abstract and declarative content. Therefore, in this paper, we present a new framework that specifies the level of Secure SDLC desired by enterprises. We propose the CIA (functional Correctness, safety Integrity, security Assurance)-level based Security-by-Design framework which combines an evidence-based security approach standard with existing Secure SDLC. By using our methodology, we can quantitatively show any differences in Secure SDLC process level employed between the company in question one of its competitors. In addition, our framework is very useful when you want to build Secure SDLC in the field because you can easily derive detailed security activities and documents to build the desired level of Secure SDLC.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Explore related subjects
Discover the latest articles, news and stories from top researchers in related subjects.References
ACM (2021) https://dl.acm.org/. Accessed 1 Feb 2021
Anderson JP (1972) Computer security technology planning study. ANDERSON (JAMES P) AND CO FORT WASHINGTON PA FORT WASHINGTON
Asad M, Ahmed S (2016) Model Driven Architecture for Secure Software Development Life Cycle. Int J Comput Sci Inf Secur (IJCSIS) 14(6)
Avizienis A et al (2004) Basic concepts and taxonomy of dependable and secure computing. IEEE Trans Depend Secure Comput 1(1):11–33
Bacic E (1990) The Canadian trusted computer product evaluation criteria (CTCPEC). In: Proceedings of the sixth annual computer security applications conference. IEEE
Barbosa M et al (2017) SAFETHINGS: data security by design in the IoT. In: 2017 13th European dependable computing conference (EDCC). IEEE
Beckers K (2015) The CAST method for comparing security standards. In: Pattern and security requirements. Springer, Cham, pp 51–83
Beckers K et al (2014) A structured comparison of security standards. In: Engineering secure future internet services and systems. Springer, Cham, pp 1–34
Beltran V et al (2016) An ARM-compliant IoT platform: security-by-design for the smart home. In: 2016 IEEE 5th Global Conference on consumer electronics. IEEE, 2016
Bhalla N et al (2019) Security risk identification in a secure software lifecycle. U.S. Patent Application No. 15784072
Białas A (2006) Development of an integrated, risk-based platform for information and E-services security. In: International conference on computer safety, reliability, and security. Springer, Berlin, Heidelberg
Brunner M et al (2017) Towards an integrated model for safety and security requirements of cyber-physical systems. In: 2017 IEEE international conference on software quality, reliability and security companion (QRS-C). IEEE
Carter A (2015) The Department of Defense cyber strategy. The US Department of Defense, Washington
Casola V et al (2016) Security-by-design in clouds: a security-SLA driven methodology to build secure cloud applications. Cloud Forward
Casola V et al (2018) Security-by-design in multi-cloud applications: an optimization approach. Inf Sci 454:344–362
Casola V et al (2020) A novel Security-by-Design methodology: modeling and assessing security by SLAs with a quantitative approach. J Syst Softw 163:110537
Cavoukian A, Dixon M (2013) Privacy and security-by-design: an enterprise architecture approach. Information and Privacy Commissioner of Ontario
Chandra P, Team OWASP (2013) Software Assurance Maturity Model., Version 1.0. (2013)
Chattopadhyay A, Lam K-Y, Tavva Y (2020) Autonomous vehicle: security by design. IEEE Trans Intell Transport Syst
Chen E et al (2013) Designing security into software during the development lifecycle. U.S. Patent Application No. 13619581
Cherdantseva, Y, Hilton J (2015) Information security and information assurance: discussion about the meaning, scope, and goals. In: Standards and Standardization: Concepts, Methodologies, Tools, and Applications. IGI Global, pp 1204–1235
Cicotti G (2017) An evidence-based risk-oriented V-model methodology to develop ambient intelligent medical software. J Reliab Intell Environ 3(1):41–53
CSA (2017) Security-by-Design Framework version 1.0. 2017
Curtis B (2014) Delivering security by design in the Internet of Things. In: 2014 international test conference. IEEE
Debouk R (2018) Overview of the 2nd Edition of ISO 26262: functional safety–road vehicles. General Motors Company, Warren
Deveci E, Caglayan MU (2015) Model driven security framework for software design and verification. Secur Commun Netw 8(16):2768–2792
Dupont S et al (2020) D5.1 Assessment specifications and roadmap. SPARTA project white paper, 2020.
Dyba T, Kitchenham BA, Jorgensen M (2005) Evidence-based software engineering for practitioners. IEEE Softw 22(1):58–65
Eloff JHP, Eloff M (2003) Information security management: a new paradigm. In: Proceedings of the 2003 annual research conference of the South African institute of computer scientists and information technologists on enablement through technology
Elsevier (2021) https://www.sciencedirect.com/. Accessed 1 Feb 2021
Fisher K, Launchbury J, Richards R (2017) The HACMS program: using formal methods to eliminate exploitable bugs. Philos Trans R Soc Math Phys Eng Sci 375(2104):20150401
Formoso S, Felici M (2015) Evidence-based security and privacy assurance in cloud ecosystems. In: IFIP international summer school on privacy and identity management. Springer, Cham
Futcher L, von Solms R (2007) SecSDM: a model for integrating security into the software development life cycle. In: IFIP world conference on information security education. Springer, New York, NY
Geismann J, Gerking C, Bodden E (2018) Towards ensuring Security-by-Design in cyber-physical systems engineering processes. In: Proceedings of the 2018 international conference on software and system process
Google Scholar (2021) https://scholar.google.co.kr/. Accessed 1 Feb 2021
Hardin R (1996) Trustworthiness. Ethics 107(1):26–42
Herrmann DS (2001) A practical guide to security engineering and information assurance. CRC Press
Holtmanns S, Lindholm R (2018) Enhanced lifecycle management of security module. Patent Application No. CN103988530A
Hoxey C, Shoemaker D (2005) Navigating the information security landscape: mapping the relationship between ISO 15408: 1999 and ISO 17799: 2000. In: AMCIS 2005 Proceedings (2005), p 448
Hunt E (2011) US Government computer penetration programs and the implications for cyberwar. IEEE Ann Hist Comput 34(3):4–21
IEEE (2021) https://ieeexplore.ieee.org/. Accessed 1 Feb 2021
Instruction, DoD (1997) DoD Information Technology Security Certification and Accreditation Process (DITSCAP). 1997.
Instruction, DoD (2000) National Information Assurance Certification and Accreditation Process (NIACAP). 2000
Instruction, DoD (2011) DoD Information Assurance Certification and Accreditation Process (DIACAP). 2011
ISO (2009) ISO/IEC 15408:2009 Information technology—security techniques—evaluation criteria for IT security (CC: Common Criteria)
ISO (2013) ISO/IEC 27001 information security management (ISMS)
ISO (2019) ISO/IEC 27701:2019 Security techniques—Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management—Requirements and guidelines (PIMS)
Jahl C (1991) The information technology security evaluation criteria (ITSEC). In: 13th international conference on software engineering. IEEE
Jürjens J (2002) UMLsec: extending UML for secure systems development. In: International conference on the unified modeling language. Springer, Berlin, Heidelberg
Karim NSA et al (2016) The practice of secure software development in SDLC: an investigation through existing model and a case study. Secur Commun Netw 9(18):5333–5345
Kitchenham BA, Dyba T, Jorgensen M (2004) Evidence-based software engineering. In: Proceedings of 26th international conference on software engineering. IEEE
Klein G et al (2014) Comprehensive formal verification of an OS microkernel. ACM Trans Comput Syst (TOCS) 32(1):1–70
Klein, G et al (2009) seL4: formal verification of an OS kernel. In: Proceedings of the ACM SIGOPS 22nd symposium on operating systems principles
Kondeva A et al (2019) On computer-aided techniques for supporting safety and security co-engineering. In: 2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW). IEEE, 2019
Kreitz M (2019) Security by design in software engineering. ACM SIGSOFT Softw Eng Notes 44(3):23–23
Kriaa S et al (2015) A survey of approaches combining safety and security for industrial control systems. Reliab Eng Syst Saf 139:156–178
Kumar R et al (2014) CakeML: a verified implementation of ML. ACM SIGPLAN Notices 49(1):179–191
Latham DC (1986) Department of defense trusted computer system evaluation criteria. Department of Defense
Lee Y, Lee J, Lee Z (2002) Integrating software lifecycle process standards with security engineering. Comput Secur 21(4):345–355
Lipner S (2004) The trustworthy computing security development lifecycle. In: 20th annual computer security applications conference. IEEE
Lockeed M (2020) cyber resiliency level (CRL) framework V3.0 for weapon, mission, and training systems. 2020
Lodderstedt, T, Basin D, Doser J (2002) SecureUML: a UML-based modeling language for model-driven security. In: International Conference on the Unified Modeling Language. Springer, Berlin, Heidelberg, 2002
Macher G et al (2016) A review of threat analysis and risk assessment methods in the automotive context. In: International conference on computer safety, reliability, and security. Springer, Cham
McGraw G (1998) Testing for security during development: why we should scrap penetrate-and-patch. IEEE Aerosp Electron Syst Mag 13(4):13–15
McGraw G, Chess B, Migues S (2009) Building security in maturity model. Fortify & Cigital
Mellado D, Fernández-Medina E, Piattini M (2007) A common criteria based security requirements engineering process for the development of secure information systems. Comput Stand Interfaces 29(2):244–253
Mellado D, Fernández-Medina E, Piattini M (2008) Towards security requirements management for software product lines: a security domain requirements engineering process. Comput Stand Interfaces 30(6):361–371
Mellado D et al (2010) A systematic review of security requirements engineering. Comput Stand Interfaces 32(4):153–165
Mesquida AL, Mas A (2015) Implementing information security best practices on software lifecycle processes: the ISO/IEC 15504 Security Extension. Comput Secur 48:19–34
Microsofot (2007) "Windows Vista vs Windows XP SP2 Vulnerability Report 2007.", 2007
Microsoft (2012) security development lifecycle-SDL process guidance version 5.2
Mir TM et al (2012) Threat analysis and modeling during a software development lifecycle of a software application. U.S. Patent No. 8091065
Mohammed NM et al (2017) Exploring software security approaches in software development lifecycle: a systematic mapping study. Comput Stand Interfaces 50:107–115
Morrison P et al (2018) Mapping the field of software life cycle security metrics. Inf Softw Technol 102:146–159
Murray T et al (2013) seL4: from general purpose to a proof of information flow enforcement. In: 2013 IEEE Symposium on Security and Privacy. IEEE, 2013
Naqvi, B, Porras J (2020) Usable security by design: a pattern approach. In: International conference on human-computer interaction. Springer, Cham
Nayerifard T, Modiri N, Jabbehdari S (2013) An approach for software security evaluation based on ISO/IEC 15408 in the ISMS implementation. Int J Comput Sci Inf Secur 11(9):7
Neureiter C, Engel D, Uslar M (2016) Domain specific and model based systems engineering in the smart grid as prerequesite for security by design. Electronics 5(2):24
Nguyen PH et al (2015) An extensive systematic review on the Model-Driven Development of secure systems. Inf Softw Technol 68:62–81
Nigam V, Pretschner A, Ruess H (2018) "Model-based safety and security engineering. arXiv preprint arXiv:1810.04866
NIST (2018) Special Publication 800–37, Revision 2. In: Risk Management Framework for Information Systems and Organizations, May (2018), pp 800–837
NIST (2019) NIST SP 800-64 revision 2—security considerations in the system development life cycle
Qian, K, Parizi RM, Lo D (2018) "Owasp risk analysis driven security requirements specification for secure android mobile software development." 2018 IEEE Conference on Dependable and Secure Computing (DSC). IEEE, 2018.
Rauf I, Troubitsyna E (2017) Towards a model-driven security assurance of open source components. International workshop on software engineering for resilient systems. Springer, Cham
Sabaliauskaite G, Mathur AP (2015) Aligning cyber-physical system safety and security. In: Complex systems design & management Asia. Springer, Cham, pp 41–53
Sabo SR (1992) Security-by-design. Am Sch Board J 180(1):37–39
SAFECode (2018) fundamental practices for secure software development 2nd edition. 2018
Sánchez-Gordón M-L et al (2017) Towards the integration of security practices in the software implementation process of ISO/IEC 29110: a mapping. In: European conference on software process improvement. Springer, Cham
Sargsyan G et al (2019) Blockchain security by design framework for trust and adoption in IoT environment. In: 2019 IEEE world congress on services (SERVICES), vol 2642. IEEE
Schilder M et al (2018) Secure device state apparatus and method and lifecycle management. U.S. Patent No. 10223531
Schmittner, C, Ma Z, Schoitsch E (2015) Combined safety and security development lifecycle. In: 2015 IEEE 13th international conference on industrial informatics (INDIN). IEEE
Scopus (2021) https://www.scopus.com/. Accessed 1 Feb 2021
Sheikhpour R, Modiri N (2012) A best practice approach for integration of ITIL and ISO/IEC 27001 services for information security management. Indian J Sci Technol 5(2):2170–2176
Spiekermann S (2012) The challenges of privacy by design. Commun ACM 55(7):38–40
Springer (2021) https://www.springer.com/. Accessed 1 Feb 2021
Steger M et al (2016) A security metric for structured security analysis of cyber-physical systems supporting SAE J3061. In: 2016 2nd international workshop on modelling, analysis, and control of complex CPS (CPS Data). IEEE
Tiirik K (2013) Comparison of SDL and Touchpoints. Obtenido de https://courses.cs.ut.ee/MTAT. Accessed 1 Feb 2021
UNECE (2020) Draft Cyber Security Regulation - final clean version
Uslar, M, Rosinger C, Schlegel S (2014) Security-by-design for the smart grid: combining the SGAM and NISTIR 7628. In: 2014 IEEE 38th international computer software and applications conference workshops. IEEE
Veloudis S et al (2019) Achieving security-by-design through ontology-driven attribute-based access control in cloud environments. Future Gener Comput Syst 93:373–391
Verginadis Y et al (2017) Password: a holistic data privacy and security by design framework for cloud services. J Grid Comput 15(2):219–234
Viega J (2010) Security in the software development lifecycle. Retrieved April 13 (2004): 2010
Viega J, McGraw G (2011) Building secure software: how to avoid security problems the right way. Addison-Wesley Professional
Vincent B, Gordon A (2020). Security configuration lifecycle account protection for minors. U.S. Patent Application No. 16022554
Voas J et al (1996) Defining an adaptive software security metric from a dynamic software failure tolerance measure. In: Proceedings of 11th annual conference on computer assurance. COMPASS'96. IEEE
Volve (2018) Connected vehicle cybersecurity volvo group trucks technology. 2018
Wilcock L et al (2012) Automated lifecycle management of a computer implemented service. U.S. Patent No. 8312419
Williams L (2019) Secure software lifecycle knowledge area. The National Cyber Security Centre
Williams P, Steward T (2007) DoD’s information assurance certification & accreditation process. Defense at L 36(5):12
Yin, L, Qiu F-L (2010) A novel method of security requirements development integrated common criteria. In: 2010 International conference on computer design and applications, vol 5. IEEE
Young W, Leveson NG (2014) An integrated approach to safety and security based on systems theory. Commun ACM 57(2):31–35
Acknowledgements
This work was supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government(MSIT) (No.2018-0-00532,Development of High-Assurance(≥ EAL6) Secure Microkernel).
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Appendix 1
Appendix 1
Table 10 shows the mapping result between Secure SDLC security activities and detailed security activities of evidence-based security approach standard by Activity-Evidence Mapper in CIA-Level Driven SDLC Framework.
Rights and permissions
About this article
Cite this article
Kang, S., Kim, S. CIA-level driven secure SDLC framework for integrating security into SDLC process. J Ambient Intell Human Comput 13, 4601–4624 (2022). https://doi.org/10.1007/s12652-021-03450-z
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s12652-021-03450-z