Skip to main content
SpringerLink
Log in

CIA-level driven secure SDLC framework for integrating security into SDLC process

  • Original Research
  • Published:
Journal of Ambient Intelligence and Humanized Computing Aims and scope Submit manuscript

Abstract

From the early 1970s, the U.S. government began to recognize that simple penetration testing could not assure the security quality of products. The results of penetration testing such as identified vulnerabilities and faults can vary depending on the capabilities of the team. In other words, the penetration testing team cannot assure that “vulnerabilities are not found” is equal to “product does not have any vulnerabilities”. So the U.S. government realized that in order to improve the security quality of products, the development process itself should be managed in a strict, systematic manner. The US government began to publish various standards related to development methodology and evaluation procurement systems, embedding the “Security-by-Design” concept from the 1980s. Security-by-Design involves reducing a product’s complexity by considering security from the early phase of the development life-cycle such as during the product requirements analysis and design phase to ultimately achieve trustworthiness of the product. Since then, the Security-by-Design concept has spread to the private sector, since 2002 this has often come in the form of Secure SDLC by Microsoft and IBM, this system is currently being used in various fields such as automotive and advanced weapon systems. However, the problem is that it is not easy to implement in the field because the standards or guidelines related to Secure SDLC contain only abstract and declarative content. Therefore, in this paper, we present a new framework that specifies the level of Secure SDLC desired by enterprises. We propose the CIA (functional Correctness, safety Integrity, security Assurance)-level based Security-by-Design framework which combines an evidence-based security approach standard with existing Secure SDLC. By using our methodology, we can quantitatively show any differences in Secure SDLC process level employed between the company in question one of its competitors. In addition, our framework is very useful when you want to build Secure SDLC in the field because you can easily derive detailed security activities and documents to build the desired level of Secure SDLC.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7

Similar content being viewed by others

References

  • ACM (2021) https://dl.acm.org/. Accessed 1 Feb 2021

  • Anderson JP (1972) Computer security technology planning study. ANDERSON (JAMES P) AND CO FORT WASHINGTON PA FORT WASHINGTON

  • Asad M, Ahmed S (2016) Model Driven Architecture for Secure Software Development Life Cycle. Int J Comput Sci Inf Secur (IJCSIS) 14(6)

  • Avizienis A et al (2004) Basic concepts and taxonomy of dependable and secure computing. IEEE Trans Depend Secure Comput 1(1):11–33

    Article  Google Scholar 

  • Bacic E (1990) The Canadian trusted computer product evaluation criteria (CTCPEC). In: Proceedings of the sixth annual computer security applications conference. IEEE

  • Barbosa M et al (2017) SAFETHINGS: data security by design in the IoT. In: 2017 13th European dependable computing conference (EDCC). IEEE

  • Beckers K (2015) The CAST method for comparing security standards. In: Pattern and security requirements. Springer, Cham, pp 51–83

    Chapter  Google Scholar 

  • Beckers K et al (2014) A structured comparison of security standards. In: Engineering secure future internet services and systems. Springer, Cham, pp 1–34

    Google Scholar 

  • Beltran V et al (2016) An ARM-compliant IoT platform: security-by-design for the smart home. In: 2016 IEEE 5th Global Conference on consumer electronics. IEEE, 2016

  • Bhalla N et al (2019) Security risk identification in a secure software lifecycle. U.S. Patent Application No. 15784072

  • Białas A (2006) Development of an integrated, risk-based platform for information and E-services security. In: International conference on computer safety, reliability, and security. Springer, Berlin, Heidelberg

    Google Scholar 

  • Brunner M et al (2017) Towards an integrated model for safety and security requirements of cyber-physical systems. In: 2017 IEEE international conference on software quality, reliability and security companion (QRS-C). IEEE

  • Carter A (2015) The Department of Defense cyber strategy. The US Department of Defense, Washington

    Google Scholar 

  • Casola V et al (2016) Security-by-design in clouds: a security-SLA driven methodology to build secure cloud applications. Cloud Forward

  • Casola V et al (2018) Security-by-design in multi-cloud applications: an optimization approach. Inf Sci 454:344–362

    Article  MathSciNet  Google Scholar 

  • Casola V et al (2020) A novel Security-by-Design methodology: modeling and assessing security by SLAs with a quantitative approach. J Syst Softw 163:110537

    Article  Google Scholar 

  • Cavoukian A, Dixon M (2013) Privacy and security-by-design: an enterprise architecture approach. Information and Privacy Commissioner of Ontario

    Google Scholar 

  • Chandra P, Team OWASP (2013) Software Assurance Maturity Model., Version 1.0. (2013)

  • Chattopadhyay A, Lam K-Y, Tavva Y (2020) Autonomous vehicle: security by design. IEEE Trans Intell Transport Syst

  • Chen E et al (2013) Designing security into software during the development lifecycle. U.S. Patent Application No. 13619581

  • Cherdantseva, Y, Hilton J (2015) Information security and information assurance: discussion about the meaning, scope, and goals. In: Standards and Standardization: Concepts, Methodologies, Tools, and Applications. IGI Global, pp 1204–1235

  • Cicotti G (2017) An evidence-based risk-oriented V-model methodology to develop ambient intelligent medical software. J Reliab Intell Environ 3(1):41–53

    Article  Google Scholar 

  • CSA (2017) Security-by-Design Framework version 1.0. 2017

  • Curtis B (2014) Delivering security by design in the Internet of Things. In: 2014 international test conference. IEEE

  • Debouk R (2018) Overview of the 2nd Edition of ISO 26262: functional safety–road vehicles. General Motors Company, Warren

    Google Scholar 

  • Deveci E, Caglayan MU (2015) Model driven security framework for software design and verification. Secur Commun Netw 8(16):2768–2792

    Article  Google Scholar 

  • Dupont S et al (2020) D5.1 Assessment specifications and roadmap. SPARTA project white paper, 2020.

  • Dyba T, Kitchenham BA, Jorgensen M (2005) Evidence-based software engineering for practitioners. IEEE Softw 22(1):58–65

    Article  Google Scholar 

  • Eloff JHP, Eloff M (2003) Information security management: a new paradigm. In: Proceedings of the 2003 annual research conference of the South African institute of computer scientists and information technologists on enablement through technology

  • Elsevier (2021) https://www.sciencedirect.com/. Accessed 1 Feb 2021

  • Fisher K, Launchbury J, Richards R (2017) The HACMS program: using formal methods to eliminate exploitable bugs. Philos Trans R Soc Math Phys Eng Sci 375(2104):20150401

    Google Scholar 

  • Formoso S, Felici M (2015) Evidence-based security and privacy assurance in cloud ecosystems. In: IFIP international summer school on privacy and identity management. Springer, Cham

  • Futcher L, von Solms R (2007) SecSDM: a model for integrating security into the software development life cycle. In: IFIP world conference on information security education. Springer, New York, NY

  • Geismann J, Gerking C, Bodden E (2018) Towards ensuring Security-by-Design in cyber-physical systems engineering processes. In: Proceedings of the 2018 international conference on software and system process

  • Google Scholar (2021) https://scholar.google.co.kr/. Accessed 1 Feb 2021

  • Hardin R (1996) Trustworthiness. Ethics 107(1):26–42

    Article  Google Scholar 

  • Herrmann DS (2001) A practical guide to security engineering and information assurance. CRC Press

    Book  Google Scholar 

  • Holtmanns S, Lindholm R (2018) Enhanced lifecycle management of security module. Patent Application No. CN103988530A

  • Hoxey C, Shoemaker D (2005) Navigating the information security landscape: mapping the relationship between ISO 15408: 1999 and ISO 17799: 2000. In: AMCIS 2005 Proceedings (2005), p 448

  • Hunt E (2011) US Government computer penetration programs and the implications for cyberwar. IEEE Ann Hist Comput 34(3):4–21

    Article  MathSciNet  Google Scholar 

  • IEEE (2021) https://ieeexplore.ieee.org/. Accessed 1 Feb 2021

  • Instruction, DoD (1997) DoD Information Technology Security Certification and Accreditation Process (DITSCAP). 1997.

  • Instruction, DoD (2000) National Information Assurance Certification and Accreditation Process (NIACAP). 2000

  • Instruction, DoD (2011) DoD Information Assurance Certification and Accreditation Process (DIACAP). 2011

  • ISO (2009) ISO/IEC 15408:2009 Information technology—security techniques—evaluation criteria for IT security (CC: Common Criteria)

  • ISO (2013) ISO/IEC 27001 information security management (ISMS)

  • ISO (2019) ISO/IEC 27701:2019 Security techniques—Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management—Requirements and guidelines (PIMS)

  • Jahl C (1991) The information technology security evaluation criteria (ITSEC). In: 13th international conference on software engineering. IEEE

  • Jürjens J (2002) UMLsec: extending UML for secure systems development. In: International conference on the unified modeling language. Springer, Berlin, Heidelberg

  • Karim NSA et al (2016) The practice of secure software development in SDLC: an investigation through existing model and a case study. Secur Commun Netw 9(18):5333–5345

    Article  Google Scholar 

  • Kitchenham BA, Dyba T, Jorgensen M (2004) Evidence-based software engineering. In: Proceedings of 26th international conference on software engineering. IEEE

  • Klein G et al (2014) Comprehensive formal verification of an OS microkernel. ACM Trans Comput Syst (TOCS) 32(1):1–70

    Article  Google Scholar 

  • Klein, G et al (2009) seL4: formal verification of an OS kernel. In: Proceedings of the ACM SIGOPS 22nd symposium on operating systems principles

  • Kondeva A et al (2019) On computer-aided techniques for supporting safety and security co-engineering. In: 2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW). IEEE, 2019

  • Kreitz M (2019) Security by design in software engineering. ACM SIGSOFT Softw Eng Notes 44(3):23–23

    Article  Google Scholar 

  • Kriaa S et al (2015) A survey of approaches combining safety and security for industrial control systems. Reliab Eng Syst Saf 139:156–178

    Article  Google Scholar 

  • Kumar R et al (2014) CakeML: a verified implementation of ML. ACM SIGPLAN Notices 49(1):179–191

    Article  MATH  Google Scholar 

  • Latham DC (1986) Department of defense trusted computer system evaluation criteria. Department of Defense

    Google Scholar 

  • Lee Y, Lee J, Lee Z (2002) Integrating software lifecycle process standards with security engineering. Comput Secur 21(4):345–355

    Article  Google Scholar 

  • Lipner S (2004) The trustworthy computing security development lifecycle. In: 20th annual computer security applications conference. IEEE

  • Lockeed M (2020) cyber resiliency level (CRL) framework V3.0 for weapon, mission, and training systems. 2020

  • Lodderstedt, T, Basin D, Doser J (2002) SecureUML: a UML-based modeling language for model-driven security. In: International Conference on the Unified Modeling Language. Springer, Berlin, Heidelberg, 2002

  • Macher G et al (2016) A review of threat analysis and risk assessment methods in the automotive context. In: International conference on computer safety, reliability, and security. Springer, Cham

  • McGraw G (1998) Testing for security during development: why we should scrap penetrate-and-patch. IEEE Aerosp Electron Syst Mag 13(4):13–15

    Article  Google Scholar 

  • McGraw G, Chess B, Migues S (2009) Building security in maturity model. Fortify & Cigital

    Google Scholar 

  • Mellado D, Fernández-Medina E, Piattini M (2007) A common criteria based security requirements engineering process for the development of secure information systems. Comput Stand Interfaces 29(2):244–253

    Article  Google Scholar 

  • Mellado D, Fernández-Medina E, Piattini M (2008) Towards security requirements management for software product lines: a security domain requirements engineering process. Comput Stand Interfaces 30(6):361–371

    Article  Google Scholar 

  • Mellado D et al (2010) A systematic review of security requirements engineering. Comput Stand Interfaces 32(4):153–165

    Article  Google Scholar 

  • Mesquida AL, Mas A (2015) Implementing information security best practices on software lifecycle processes: the ISO/IEC 15504 Security Extension. Comput Secur 48:19–34

    Article  Google Scholar 

  • Microsofot (2007) "Windows Vista vs Windows XP SP2 Vulnerability Report 2007.", 2007

  • Microsoft (2012) security development lifecycle-SDL process guidance version 5.2

  • Mir TM et al (2012) Threat analysis and modeling during a software development lifecycle of a software application. U.S. Patent No. 8091065

  • Mohammed NM et al (2017) Exploring software security approaches in software development lifecycle: a systematic mapping study. Comput Stand Interfaces 50:107–115

    Article  Google Scholar 

  • Morrison P et al (2018) Mapping the field of software life cycle security metrics. Inf Softw Technol 102:146–159

    Article  Google Scholar 

  • Murray T et al (2013) seL4: from general purpose to a proof of information flow enforcement. In: 2013 IEEE Symposium on Security and Privacy. IEEE, 2013

  • Naqvi, B, Porras J (2020) Usable security by design: a pattern approach. In: International conference on human-computer interaction. Springer, Cham

  • Nayerifard T, Modiri N, Jabbehdari S (2013) An approach for software security evaluation based on ISO/IEC 15408 in the ISMS implementation. Int J Comput Sci Inf Secur 11(9):7

    Google Scholar 

  • Neureiter C, Engel D, Uslar M (2016) Domain specific and model based systems engineering in the smart grid as prerequesite for security by design. Electronics 5(2):24

    Article  Google Scholar 

  • Nguyen PH et al (2015) An extensive systematic review on the Model-Driven Development of secure systems. Inf Softw Technol 68:62–81

    Article  Google Scholar 

  • Nigam V, Pretschner A, Ruess H (2018) "Model-based safety and security engineering. arXiv preprint arXiv:1810.04866

  • NIST (2018) Special Publication 800–37, Revision 2. In: Risk Management Framework for Information Systems and Organizations, May (2018), pp 800–837

  • NIST (2019) NIST SP 800-64 revision 2—security considerations in the system development life cycle

  • Qian, K, Parizi RM, Lo D (2018) "Owasp risk analysis driven security requirements specification for secure android mobile software development." 2018 IEEE Conference on Dependable and Secure Computing (DSC). IEEE, 2018.

  • Rauf I, Troubitsyna E (2017) Towards a model-driven security assurance of open source components. International workshop on software engineering for resilient systems. Springer, Cham

    Google Scholar 

  • Sabaliauskaite G, Mathur AP (2015) Aligning cyber-physical system safety and security. In: Complex systems design & management Asia. Springer, Cham, pp 41–53

    Chapter  Google Scholar 

  • Sabo SR (1992) Security-by-design. Am Sch Board J 180(1):37–39

    Google Scholar 

  • SAFECode (2018) fundamental practices for secure software development 2nd edition. 2018

  • Sánchez-Gordón M-L et al (2017) Towards the integration of security practices in the software implementation process of ISO/IEC 29110: a mapping. In: European conference on software process improvement. Springer, Cham

    Google Scholar 

  • Sargsyan G et al (2019) Blockchain security by design framework for trust and adoption in IoT environment. In: 2019 IEEE world congress on services (SERVICES), vol 2642. IEEE

  • Schilder M et al (2018) Secure device state apparatus and method and lifecycle management. U.S. Patent No. 10223531

  • Schmittner, C, Ma Z, Schoitsch E (2015) Combined safety and security development lifecycle. In: 2015 IEEE 13th international conference on industrial informatics (INDIN). IEEE

  • Scopus (2021) https://www.scopus.com/. Accessed 1 Feb 2021

  • Sheikhpour R, Modiri N (2012) A best practice approach for integration of ITIL and ISO/IEC 27001 services for information security management. Indian J Sci Technol 5(2):2170–2176

    Google Scholar 

  • Spiekermann S (2012) The challenges of privacy by design. Commun ACM 55(7):38–40

    Article  Google Scholar 

  • Springer (2021) https://www.springer.com/. Accessed 1 Feb 2021

  • Steger M et al (2016) A security metric for structured security analysis of cyber-physical systems supporting SAE J3061. In: 2016 2nd international workshop on modelling, analysis, and control of complex CPS (CPS Data). IEEE

  • Tiirik K (2013) Comparison of SDL and Touchpoints. Obtenido de https://courses.cs.ut.ee/MTAT. Accessed 1 Feb 2021

  • UNECE (2020) Draft Cyber Security Regulation - final clean version

  • Uslar, M, Rosinger C, Schlegel S (2014) Security-by-design for the smart grid: combining the SGAM and NISTIR 7628. In: 2014 IEEE 38th international computer software and applications conference workshops. IEEE

  • Veloudis S et al (2019) Achieving security-by-design through ontology-driven attribute-based access control in cloud environments. Future Gener Comput Syst 93:373–391

    Article  Google Scholar 

  • Verginadis Y et al (2017) Password: a holistic data privacy and security by design framework for cloud services. J Grid Comput 15(2):219–234

    Article  Google Scholar 

  • Viega J (2010) Security in the software development lifecycle. Retrieved April 13 (2004): 2010

  • Viega J, McGraw G (2011) Building secure software: how to avoid security problems the right way. Addison-Wesley Professional

    Google Scholar 

  • Vincent B, Gordon A (2020). Security configuration lifecycle account protection for minors. U.S. Patent Application No. 16022554

  • Voas J et al (1996) Defining an adaptive software security metric from a dynamic software failure tolerance measure. In: Proceedings of 11th annual conference on computer assurance. COMPASS'96. IEEE

  • Volve (2018) Connected vehicle cybersecurity volvo group trucks technology. 2018

  • Wilcock L et al (2012) Automated lifecycle management of a computer implemented service. U.S. Patent No. 8312419

  • Williams L (2019) Secure software lifecycle knowledge area. The National Cyber Security Centre

    Google Scholar 

  • Williams P, Steward T (2007) DoD’s information assurance certification & accreditation process. Defense at L 36(5):12

    Google Scholar 

  • Yin, L, Qiu F-L (2010) A novel method of security requirements development integrated common criteria. In: 2010 International conference on computer design and applications, vol 5. IEEE

  • Young W, Leveson NG (2014) An integrated approach to safety and security based on systems theory. Commun ACM 57(2):31–35

    Article  Google Scholar 

Download references

Acknowledgements

This work was supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government(MSIT) (No.2018-0-00532,Development of High-Assurance(≥ EAL6) Secure Microkernel).

Author information

Authors and Affiliations

  1. ICSP (Institute of Cyber Security & Privacy), School of Cybersecurity, Korea University, Seoul, South Korea

    Sooyoung Kang & Seungjoo Kim

Authors
  1. Sooyoung Kang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Seungjoo Kim
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Seungjoo Kim.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Appendix 1

Appendix 1

Table 10 shows the mapping result between Secure SDLC security activities and detailed security activities of evidence-based security approach standard by Activity-Evidence Mapper in CIA-Level Driven SDLC Framework.

Table 10 Mapping result of Secure SDLC and evidence-based security approach standards
Full size table

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Kang, S., Kim, S. CIA-level driven secure SDLC framework for integrating security into SDLC process. J Ambient Intell Human Comput 13, 4601–4624 (2022). https://doi.org/10.1007/s12652-021-03450-z

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s12652-021-03450-z

Keywords

Search

Navigation