Software Security

By
Dr. S.Jagadeesan
Assistant Professor (Senior
Grade2)
School of Information Technology
VIT Vellore
and Engineering , 1
 Module 7 – Managing a Secure Software

Security and Project Management – Project Scope and Plan,

Resource, Estimate the Resources, Product and Project
Resources, Measuring Software Security, Maturity of Practice.

2
Project Management

3
 Establish a project management structure
1. Establish Roles and Responsibilities: Assign roles and responsibilities to each
team member and create a clear chain of command.

2. Develop a Communication Strategy: Develop a plan that outlines how

communication will be handled within the project team and with other
stakeholders.

3. Set Expectations: Define expectations for each team member, including goals,
deadlines, and deliverables.

4. Implement Project Management Software: Utilize project management

software to track progress and keep the project on schedule.

5. Monitor Performance: Monitor team performance and measure progress

against the project plan. Identify any issues that arise and take corrective action.
 Project Definition
1. Scope: Define the project’s goals, objectives, deliverables, and timeline.

2. Budget: Estimate the cost of the project and develop a budget.

3. Resources: Identify the resources needed to complete the project, including

personnel, materials, and equipment.

4. Risk Management: Identify potential risks and develop a plan to moderate

those risks.

5. Quality Assurance: Establish the quality standards for the project and

develop a plan to ensure those standards are met.

 Security and Project Management
• Continuous risk management and periodic risk assessment are key
activities that help guide project managers in determining which security
practices to incorporate in each life-cycle activity and to what degree.

• Software security requirements affect project planning and monitoring,

with respect to the following aspects of the project:
• The project’s scope
• The project plan
• Tools, knowledge, and expertise
• Estimating the nature and duration of required resources
• Project and product risks 6
 Project Management
• The overall goal of project planning is to establish a realistic strategy for
controlling, tracking, and monitoring a complex technical project.
• Why?
• So the end result gets done on time, with quality!

7
8
Risk Types

9
Project Scope
• Security's impact on the scope of the project has several dimensions
that need to be considered throughout project planning and
execution.
• These dimensions influence all SDLC activities and need to be
specifically addressed in the final software and system before they are
approved for release:
• The type and number of threats
• The sophistication of and resources available to the attacker
• The desired response to an attack
• The level of required assurance that the system meets its
security requirements

1
0
Understanding Project Scope
• Understand the customers needs
• Understand the business context
• Understand the project boundaries
• Understand the customer’s motivation
• Understand the likely paths for change

1
1
Project Plan
• The nature of security risks and their consequences affect both
project planning and resources. Actions to mitigate low-consequence
and low-likelihood risks can often be left to the discretion of the
project leader with limited management review.
• The complexity associated with product development may be a
consequence of tight component integration to meet market
demands for functionality or performance.
• Shared services typically aggregate risks.
• System integration has to resolve any mismatches with both internal
and outsourced development

10
Project Planning
• Scoping—understand the problem and the work that must be done
• Estimation—how much effort? how much time?
• Risk—what can go wrong? how can we avoid it? what can we do
about it?
• Schedule—how do we allocate resources along the timeline? what
are the milestones?
• Control strategy—how do we control quality? how do we control
change?

11
Resources
• Tools
• The software development environment should be at least as secure as
the planned security level of the software being produced.
• Appropriate controls for and configuration management of
development artifacts are essential and must have required assurance
level.
• Knowledge and Expertise
• The security expertise required to develop more secure software can
be classified into two categories:
• Knowledge of security functionality and features.
• The skills to identify and mitigate exploitable vulnerabilities
12
Estimating the Nature and Duration of Required Resources
• The main objective of software project planning is to provide a framework
that enables the manager to make reasonable estimates of resources,
cost, and schedule.
• These estimates are made within a limited time frame at the beginning of a
software project and should be updated regularly as the project
progresses
• Estimates should attempt to define best case and worst case scenario so
that project outcomes can be controlled.
• Early estimates for staff effort and schedule are not very reliable until a
more detailed description of the software is available.
• Using shared services and a shared IT infrastructure across a number of
application development projects can reduce component development
costs but typically aggregates risks across all uses.
• Project estimates need to consider and reflect the increased assurance that
will need to be applied to any shared services.
13
Project and Product Risks
• Potential requirements for secure data access during development,
secure facilities, or demonstration of capability can add great
complexity and schedule concerns to projects.
• Change and configuration management procedures provide some
assurance for internal development.
• Activities such as an architectural risk assessment, threat analysis,
and static analysis for the source code provide practices for specific
development phases.
• Development controls and change management are essential
development tools.

14
Project and Product Risks

15
Thank you

16
Dr. M. LAWANYA SHRI, SITE 17