SSE ch 10 video

Overview of Best Practices in Software Engineering and Security

• This lesson serves as an overview of the best practices in incorporating security into software engineering.

• The importance of integrating security into every aspect of software engineering is emphasized, considering it an ongoing process rather than a one-time activity.

Understanding Software Engineering

• Good understanding of software engineering is essential to appreciate the incorporation of security practices.

• Adequate industry experience (approximately five to six years) helps to appreciate the nuances of software engineering practices.

Root Concepts

• Resilience:

  • Involves the system's ability to withstand and efficiently respond to attacks or adversaries.

  • Associated with accountability and preparedness for compliance.

Incorporating Security into DevOps

• DevOps Overview:

  • Transition from traditional software development to modern practices.

  • The old model involved sequentially collecting requirements, developing, testing, and deploying software with infrequent changes.

  • Modern software engineering focuses on rapid iterations, encouraging the creation of a minimum viable product (MVP) that works without all the desired features.

  • Emphasizes the concept of change in software development.

• Version Control Systems: (basically patch system—> submit patches into git)

  • Critical for tracking changes in the software, with Git being a popular choice.

  • Allows automated processes to manage code testing, deployment, and production monitoring.

• DevOps Process Flow:

  1. Code Creation: Start with a small piece of code.

  2. Issue Tracking: Bugs and issues logged into an issue tracking system (MIS) like Jira.

  3. Team Management: Issues assigned to relevant expertise (e.g., team members or managers).

  4. Testing and Deployment: Automated testing and code deployment.

  5. Feedback Loop: Gathering feedback from users or detecting bugs in production.

• Version Control Concepts:

  • Branches: Creating separate branches for bug fixes or new features to keep the main codebase stable.

  • Migrations:

  • Associating changes in the database with code changes maintaining version control of database schemas.

  • Tools and libraries exist to automate database migrations.

DevSecOps Perspective

• Definition: Incorporating security into DevOps practices, historically part of DevOps workflows, rather than a distinct addition.

• Key Principles of DevSecOps:

  • Automation and integration of security tools.

  • Continuous feedback mechanisms and automated testing processes.

  • Shared responsibility among team members, where issues are assigned and reviewed accordingly.

  • Infrastructure as Code (IaC): Defining and managing infrastructure through code using tools like Puppet and Chef.

Challenges in Security Integration

• Complexity: The rapidly changing landscape of tools and practices leads to continual adaptation.

• Cultural Resistance:

  • Difficulty in changing established workflows or practices among development teams.

  • Complexity in ensuring different tools within the ecosystem work together efficiently.

• Balance Between Security and Agility:

  • Overly stringent security measures may hinder development workflows.

• Skill Gaps: Difficulty in finding adequately skilled personnel to navigate complex environments securely.

Continuous Monitoring and Incident Management

• Essential for driving development based on previous issues and ensuring software reliability.

• Log Management: Critical to logging user interactions, addressing issues without compromising user privacy.

• Performance Monitoring: Necessary for alerting teams about potential intrusions or performance drops.

Patch Management and Security Culture

• Understanding Patches:

  • Changes made to fix bugs, often documented and sent separately for review, now more integrated into version control systems.

  • Concepts of patch cycles and automated patch deployment are central in maintaining software integrity.

• Security Culture:

  • Promoting a strong security culture is fundamental for sustained success in implementing security practices.

  • Requires transparent communication of risks and leadership commitment to integrate security into development processes.

Evaluation Metrics and Frameworks

• Measurement of Security Culture:

  • Tracking improvements or regress in vulnerability detection rates over time.

  • Analysing what changes in code lead to changes in the prevalence of vulnerabilities.

• NIST Cybersecurity Framework (CSF):

  • Provides guidelines for managing cybersecurity risk through identity, protection, detection, response, and recovery actions.

Conclusion and Reflection on the Course

• The instructor acknowledges the challenges in delivering a comprehensive course given the breadth of topics and the necessity for prior industry experience to meaningfully engage with material.

• The course is framed as a roadmap for students to explore and improve their knowledge in security practices.