Application security engineering

Making your product Secure-by-Design

at around 1% of development costs

Hacker’s insight at each step of the way

Software Security today is sub-par because people who know how to hack Software Systems don’t participate in their development.

Proper Software Security Engineering requires a cyber-security expert supporting the development team at each stage of the Software Development Life Cycle.

At SoftSeq, we address this by assigning security engineers to customers where they acquire intimate product knowledge and assist during all development stages.

Why do Secure-SDLC at all?

It’s cheaper than testing and fixing security as an afterthought.

Fixing security issues gets exponentially more expensive further along the development pipeline, requiring changing software architecture, re-writing a lot of code, re-testing all code and deployment integrations – on top of security testing – according to IBM Research.

Stages of Secure-SDLC

1. Secure Requirements Review

Before even starting to create architecture for a product or a feature, severe security issues can be introduced.

A skilled Security Engineer needs to ensure that Security Requirements are included, based on the product’s target industry, geography, and use cases, enabling the Software Architect to make decisions the company won’t regret.

2. Secure Architecture Review

Insecure architecture decisions are highly common and extremely expensive to fix, sometimes requiring years’ worth of code to be re-written.

Ensuring that Software Architecture adheres to Security Industry best practices, accounting for product-specific and common security threats, is integral to building dependable software.

3. Secure Coding Training

Software Developers are clever, but often uninformed about common Software Security issues, their root causes and security best practices.

Educating developers with Secure Coding Training is an effective way of leveraging your developer’s creativity, engineering skills, and intimate understanding of the product to protect it.

4. Secure Code Review, Testing and DevSecOps

No matter how well trained, Software Engineers work under pressure to deliver features on time.

Such focus often leads to technical security details being overlooked or sacrificed, either accidentally or to meet deadlines.

Skilled Security Engineers performing manual security code review and testing, focused solely on identifying software weaknesses, are essential to ensure product’s robustness.

Even though most automated security tools are ineffective, select few areas of application security can really benefit from some DevSecOps processes, carefully chosen and tailored to your organization.

SoftSeq offers unique in-house designed solutions that are fine-tuned to integrate with your application, leaving general-purpose security tools in the dust.

5. Penetration Testing

Even the most secure application can open up to a hacker if it’s set up and configured insecurely.

Cloud, System, and Network Security are all important aspects that need skilled testing to ensure no loose ends are left.

FAQ

• Is Secure-SDLC expensive?

No.
Upgrading SDLC to Secure-SDLC, and building Secure-by-Design software, takes 1 full-time Security Engineer per 20 full-time Programmers.
This means that cost overhead of Secure-by-Design software is only around 1% of product costs, when all development, testing, management, marketing, and other costs are factored in.
It’s also possible to prioritize activities in SDLC to achieve the best security at any given budget.

• At what stage should a startup implement Secure-SDLC?

As soon as you raise a sizable Seed or Series A round.
You become a visible target for hackers as soon as you get funding. They know you’ve been moving fast and breaking things, giving security a low priority, and now you’ve also got money.

• Does Secure-SDLC impede the development process?

No.
It’s a business decision whether security should or should not be a release criteria. Either way, you get early visibility into your product’s security posture, allowing you to prioritize future development and bug fixing work.

• When is the best time to start Secure-SDLC?

Now.
The sooner in the development process you introduce Security Engineering, the more expensive mistakes can be avoided.

There’s no software development stage that’s more or less suited for starting Secure-SDLC.

Note that Secure-SDLC addresses the security of newly developed code. For existing parts of an application, consider OWASP ASVS Security Audit as a starting point. They may be merged into an extended Secure-SDLC process, but finding security issues this way in existing code may be severely delayed.

• Should we hire and manage security engineers ourselves?

Probably not.
There are two major challenges that make hiring your own Software Security team ineffective.

Firstly, do you have software security management expertise inside your organization? Without it, unguided, even the most skilled Software Security Experts will stumble and waste their time. Setting correct goals and choosing efficient strategies to achieve them is absolutely integral.

Secondly, can you really hire top Software Security experts? The cybersecurity labor market experiences a sharp shortage of skilled workers, and it’s getting worse every year. To make matters worse, Software Security expertise is a rare skill – cybersecurity experts aren’t interchangeable.

At SoftSeq, we overcome both these challenges by leveraging decades of cybersecurity management expertise, deep internal technical training, and knowledge sharing.