A staggering amount of cybersecurity breaches are caused by software vulnerabilities. From the early worms of the 1980s through the early 2000s - like Blaster, Code Red, and Melissa - to the notable Petya and WannaCry of the past few years, these vulnerabilities are all rooted in software flaws that allowed systems to be exploited.
A Software Development Lifecycle (SDLC) policy helps your company ensure software goes through a testing process, is built as securely as possible, and that all development work is compliant as it relates to any regulatory guidelines and business needs.
Here are some primary topics your software development lifecycle policy and software development methodology should cover:
Once developers have the appropriate sandbox for the development phase of code, the next step is giving them a place to control and track changes. Version control systems take a repository of your code and project files and keep a history of all changes, which makes it easy to edit the code - while still understanding it - in the long run. Two popular version control systems include:
Next, you need to log and monitor who has access to your code and who is making changes. You also need a methodology for finding vulnerabilities within your code. Some strategies to accomplish this include:
In addition to these monitoring and reviewing approaches, you should also have a way to whitelist pre-approved code changes that have been reviewed by management, as well as quickly identify any non-approved changes that have been pushed to production. See our system changes policy for more information.
Everything we’ve talked about so far needs to be well documented, including the tools/services you use to write code, the methods used to change and publish code, as well as your approach to code review. Be sure to include narratives around your continuous integration and continuous delivery so that the path your code takes from development to staging to production is clear. This verbose documentation helps current, and future team members align with your company’s established way of doing development and also makes an auditor’s job easier.
Customers will have high expectations of your software - not only from a feature and functionality standpoint but from a security posture as well. Ensure your development strategy includes:
With headline-grabbing software vulnerabilities becoming more and more prevalent, now is the time to tighten up your development practices into a well-written SDLC policy. This particular information security policy will help your development teams standardize on coding tools and practices, as well as get everybody on the same page from a security standpoint. And come the time when you do have an incident, you will be able to demonstrate to your customers that you do indeed take their security seriously - it’s not just lip service.
To learn more on how StrongDM helps companies with SOC 2 compliance, make sure to check out our SOC 2 Compliance Use Case.
Brian Johnson, Security Engineer / Podcaster, is the president of 7 Minute Security, an information security consultancy in the Minneapolis area. Brian spends most of his days helping companies defend their networks.
Since 2004, Brian has also run the blog/podcast called 7 Minute Security, where he shares what he has learned about information security into short, 7-minute chunks.
