ENHANCING THE DEVELOPMENT LIFE CYCLE

TO PRODUCE SECURE SOFTWARE

Version 2.0

October 2008

Dependence on information technology makes software assurance a key element of business continuity, national security, and homeland security. Software vulnerabilities jeopardize intellectual property, consumer trust, business operations and services, and a broad spectrum of critical applications and infrastructure, including everything from Supervisory Control and Data Acquisition systems to commercial-off-the-shelf applications. The integrity of key assets depends upon the reliability and security of the software that enables and controls those assets. However, informed consumers have growing concerns about the scarcity of practitioners with requisite competencies to build secure software. They have concerns with suppliers’ capabilities to build and deliver secure software with requisite levels of integrity and to exercise a minimum level of responsible practice. Because software development offers opportunities to insert malicious code and to unintentionally design and build software with exploitable weaknesses, security-enhanced processes and practices—and the skilled people to perform them—are required to build software that can be trusted not to increase risk exposure.

In an era riddled with asymmetric cyber attacks, claims about system reliability, integrity and safety must also include provisions for built-in security of the enabling software.

In their Report to the President entitled Cyber Security: A Crisis of Prioritization (February 2005), the President’s Information Technology Advisory Committee (PITAC) summed up the problem of non-secure software:

Network connectivity provides "door-to-door" transportation for attackers, but vulnerabilities in the software residing in computers substantially compound the cyber security problem. As the PITAC noted in a 1999 report, the software development methods that have been the norm fail to provide the high quality, reliable, and secure software that the Information Technology infrastructure requires.

Software development is not yet a science or a rigorous discipline, and the development process by and large is not controlled to minimize the vulnerabilities that attackers exploit. Today, as with cancer, vulnerable software can be invaded and modified to cause damage to previously healthy software, and infected software can replicate itself and be carried across networks to cause damage in other systems. Like cancer, these damaging processes may be invisible to the lay person even though experts recognize that their threat is growing. And as in cancer, both preventive actions and research are critical, the former to minimize damage today and the latter to establish a foundation of knowledge and capabilities that will assist the cyber security professionals of tomorrow reduce risk and minimize damage for the long term.

Vulnerabilities in software that are introduced by mistake or poor practices are a serious problem today. In the future, the Nation may face an even more challenging problem as adversaries—both foreign and domestic—become increasingly sophisticated in their ability to insert malicious code into critical software.

Software Assurance has emerged in response to the dramatic increases in business and mission risks that are now known to be attributable to exploitable software, including:

• Dependence on software components of systems despite their being the weakest link in those systems;
• Size and complexity of software that obscures its intent and precludes exhaustive testing;
• Outsourcing of software development and reliance on unvetted software supply chains;
• Attack sophistication that eases exploitation of software weaknesses and vulnerabilities;
• Reuse and interfacing of legacy software with newer applications in increasingly complex, disparate networked environments resulting in unintended consequences and the increase of vulnerable software targets.

The growing extent of the resulting risk exposure is not yet well understood. The number of threats specifically targeting software is increasing, as the majority of today’s network- and system-level attacks exploit vulnerabilities in application-level software. These factors combine to the increase of risks to software-enabled capabilities and the vulnerability of software-intensive systems to asymmetric cyber threats. Only by establishing the basis for justifiable confidence in the software that enables their core business operations can the organizations that depend on software-intensive systems trust those systems to continue performing in a dependable, trustworthy manner, even in the face of attack.

Enhancing the Development Life Cycle to Produce Secure Software joins a growing body of software assurance information resources and tools provided through the Department of Homeland Security (DHS) BuildSecurityIn Web portal (https://buildsecurityin.us-cert.gov) that are intended to assist software developers, architects, acquirers, and educators in the improvement and verification of the quality, reliability, and security of the software they produce or procure-and in establishing the justification to use that software with confidence.

Enhancing the Development Life Cycle to Produce Secure Software[1] is intended to complement Software Security Assurance: A State-of-the-Art Report,[2] which provides an broad overview of the current methodologies, practices, technologies, and activities engaged in by government, industry, and academia for producing secure software and verifying software’s security. Enhancing the Development Life Cycle complements Software Security Assurance by describing in greater technical depth and detail the security principles and practices that software developers, testers, and integrators can adopt to achieve the twin objectives of producing more secure software-intensive systems, and verifying the security of the software they produce.

Enhancing the Development Life Cycle benefited greatly from contributions and critiques by participants in the Software Assurance Forum. The Software Assurance Forum was established jointly by the DHS and Department of Defense (DoD) Software Assurance Programs to provide a venue in which relevant initiatives and organizations across the private sector, academia, and government agencies can collaborate and partner to improve the state of the art of software development and acquisition by shaping a comprehensive strategy that addresses people, processes, technologies, and acquisition practices throughout the software life cycle.

DHS established its Software Assurance Program, consistent with the National Strategy to Secure Cyberspace which included action/recommendation 2-14: "DHS will facilitate a national public-private effort to promulgate best practices and methodologies that promote integrity, security, and reliability in software code development, including processes and procedures that diminish the possibilities of erroneous code, malicious code, or trap doors that could be introduced during development."

The co-sponsored Software Assurance Forum provides a public-private venue for stakeholders to discuss relevant issues and promote the objectives of software assurance throughout the development life cycle. The software assurance objectives are:

1. Dependability (Correct and Predictable Execution): Justifiable confidence can be attained that software, when executed, functions only as intended;
2. Trustworthiness: No exploitable vulnerabilities or malicious logic exist in the software, either intentionally or unintentionally inserted;
3. Resilience (and Survivability): If compromised, damage to the software will be minimized, and it will recover quickly to an acceptable level of operating capacity;
4. Conformance: A planned and systematic set of multi-disciplinary activities will be undertaken to ensure software processes and products conform to requirements and applicable standards and procedures.

A growing number of software and security engineers have identified and now promote principles, practices, and technologies that support these software assurance objectives. Their experiences have provided real-world evidence that software produced and vetted by such tools and practices exhibit fewer faults and weaknesses that are exploitable as vulnerabilities, while also increasing the software’s overall dependability and quality. Enhancing the Development Life Cycle describes these principles, practices, and technologies.

Recognizing that no single practice, process, or methodology offers a universal "silver bullet" for software security, the authors of Enhancing the Development Life Cycle do not set out to recommend a specific methodology. In this way, Enhancing the Development Life Cycle differs from many other works published on secure software engineering, secure programming, secure coding, application security, and similar topics.

What Enhancing the Development Life Cycle does do is present software practitioners with background in software security concepts and issues, and describes a set of frequently cited secure software principles and security-enhancing development practices. These are principles and practices that have been demonstrated in software development projects across government, industry, and academia, in the United States (U.S.) and abroad, to aid in the production, verification, and sustainment of software that is more dependable, more trustworthy, and more resilient than software produced without the benefit of those principles and practices. The information in Enhancing the Development Life Cycle is intended to prepare its readers to evaluate and choose from among the growing number of secure software development methodologies, practices, and technologies those best suited for adoption by their own development organizations to help reshape their life cycle processes and practices.

Enhancing the Development Life Cycle is expected to contribute to the growing Software Assurance community of practice. This freely downloadable document is intended solely as a source of information and guidance, and is not a proposed standard, directive, or policy from the DoD, DHS, or any other federal government organization. This document will continue to evolve with usage and changes in practice; therefore, comments on its utility and recommendations for improvement will always be welcome and should be addressed to the DACS at swa@thedacs.com or to Joe Jarzombek, the Director for Software Assurance, National Cyber Security Division, U.S. Department of Homeland Security at swa@cert.org.

¹Sponsored by the DHS Software Assurance Program and collaboratively developed through contributions of the Software Assurance Forum working groups, the document is published by the Defense Technical Information Center’s Data and Analysis Center for Software (DACS) as a community resource.
²Goertzel, Karen Mercedes, et al. Software Security Assurance: A State-of-the-Art Report. Herndon, Virginia: Information Assurance Technology Analysis Center (IATAC) of the DTIC, 31 July 2007. Accessed 28 January 2008 at: http://iac.dtic.mil/iatac/download/security.pdf

TABLE OF CONTENTS