Agile Application Security

Chapter 4. Working with Your Existing Agile Life Cycle

So you want to start building more secure software, but your security and compliance checklists require you to have design review gates and penetration testing, and you can’t work out where these fit in an Agile life cycle.

Traditional Application Security Models

In a traditional application security model, the security touchpoints during software development are mostly gates that the product must stop at and pass. Some security work is done in parallel with development, and the gates are a chance to verify that the security work and development work haven’t diverged. The following are common security gates:

Design or requirements review

The security team looks at the requirements list or early designs and adds any security requirements based on threat models and attack trees.

Architecture review

The security team reviews the proposed architecture, such as infrastructure or information flows, and proposes a set of security controls in order to minimize risk.

Code review

The security team reviews sensitive areas of code and confirms that the security requirements are met, and that the code matches the architecture.

Security testing

The security team or an external team checks the test version of the product against a set of security requirements to see if the system is safe and secure.

The idea behind these gates is that work is delivered in large batches. It is predicated on the old rule that the earlier a defect ...