Alice and Bob Learn Application Security

CHAPTER 2Security Requirements

When you create any application or embark on any project, you must have requirements for what you are going to build. This is true no matter what development methodology you use (Waterfall, Agile, DevOps), language or framework you write it in, or type of audience you serve; without a plan you cannot build something of substance.

If you have studied computer science or computer engineering, the image shown in Figure 2-1 is likely burned into your brain. It is commonly known as the System Development Life Cycle (SDLC), and it consists of five phases: Requirements, Design, Code, Testing, and Release. As this book progresses, we will refer back to this image in order to explain when each activity we talk about can and/or should occur. This chapter will revolve around the Requirements phase.

Figure 2-1: The System Development Life Cycle (SDLC)

TIP SDLC is sometimes defined as the software development life cycle, focusing on software rather than system. The two definitions are used interchangeably.

When you have your very first project meeting (often called a “project kickoff meeting”), there should be a person from the security team present, to take part in the project from its very inception. Even though this person will not be working full time on the project, they should be part of the team and make themselves available regularly to ...