Embedding Security

into Agile Development

Ten principles for rapid improvement

In a world driven by digital transformation, the advantages of agile development

are clear. It enables organisations to adapt to ever-changing business
requirements and accelerates the delivery of products, services, and applications.
However, agile development methods do not always explicitly contemplate the
need for information security even though security should be at the forefront.
The speed and frequency of application development presents unnecessary 86%
opportunities for exploitation by cyber attackers, particularly if the software
development lifecycle is not security focused.

Underpinning each of the ten agile security principles is a set of practical

of organisations have adopted agile software
considerations to be actioned by relevant stakeholders at different stages of the
development emphasising the need for
agile process. security to be immersed in the process

The ten agile

Agile programme management actions
security principles:
These tasks set the overarching parameters for securing agile development.
Typically undertaken by project sponsors and senior security managers, such as 1 Define roles and responsibilities
CIOs and CISOs, a commitment to these actions has the advantage of showing
support from the top levels of the organisation. 2 Invest in skills and training

Agile project management actions 3 Apply an information risk

management process

Designed to build security into day-to-day operations, these actions are carried
out by those with specialist project management or security expertise, such as 4 Specify security requirements
using the developers’ format
information security managers and project managers.

5 Conduct threat modelling

Agile iteration actions
6 Employ secure
Performed by software developers and information security practitioners at the programming techniques
more detailed level of application development, these tasks relate to how the
code is written, reviewed, tested and implemented. 7 Perform independent
security reviews

The modern business environment is more demanding than ever. To meet Automate security testing
8
customer expectations, maintain a competitive edge and realise business
opportunities, organisations must continuously refine their processes.
9 Include security in
With efficiency and flexibility ranking as key measures of business success, acceptance criteria
organisations have jettisoned traditional development approaches in favour of
agile ways of working.
10 Evaluate security performance
 Getting started
Fresh thinking and new
attitudes are required
to successfully integrate
security into agile ways
of working. Selecting
and assigning actions
from the ISF ten agile
security principles puts
organisations in the
best position to rapidly
improve the secure
development of their
applications.
As each agile
development project
progresses, the ongoing
evaluation of security
performance is integral
to improvement – this is
covered by Principle 10.
Where next?
Organisations should also consider the ISF resources related to this report including:
Using Cloud Services
Securely: Harnessing
the core controls
ISF report
ISF Information
Risk Assessment
Methodology 2 (IRAM2)
ISF tools and methodologies
Contact
For further information contact:
Steve Durbin
Chief Executive
US Tel: +1 (347) 767 6772
UK Tel: +44 (0)20 3289 5884
UK Mobile: +44 (0)7785 953800
steve.durbin@securityforum.org
securityforum.org
Information Security Forum
Principle title
Project stages at
which the principle
primarily applies
Specific considerations
for project sponsors,
senior IT and
information security
leaders, (e.g. CIOs
and CISOs)
Specific considerations
for agile project
management teams
(e.g. IT managers
and information
security practitioners)
Specific considerations
for software developers
and other members of
the project team
Securing Containers: Standard of Good
Keeping pace Practice for Information
with change Security 2022 (SOGP)
ISF briefing paper ISF tools and methodologies
Threat Intelligence: ISF Services
React and prepare For more information, contact
ISF report services@securityforum.org
About the ISF
The ISF is a leading authority on information security and risk management. A not‑for‑profit organisation,
we provide independent opinion and guidance on all aspects of information security. We deliver practical
solutions to overcome the wide‑ranging information security and risk management challenges that
impact business.
Disclaimer
This document has been published to provide general information only. It is not intended to provide advice
of any kind. Neither the Information Security Forum nor the Information Security Forum Limited accept any
responsibility for the consequences of any use you make of the information contained in this document.
©2023 Information Security Forum Limited | Classification: Public, no restrictions | Prepared: June 2023