Regardless of where you start, the following practices are essential when developing software with security in mind:

• Select and integrate security practices (such as those described above) with your existing software development lifecycle and development process—during an acquisition or purchase, requirements specification, architecture, design, implementation, test and deployment. The objective of including security in a defined software development lifecycle is not to overhaul an existing process totally but to add well-defined security practices and security deliverables. Security needs to be tackled in the same way that software engineers address performance and reliability.
• Think like an attacker. In addition to considering what the software should do in terms of functions, features and capabilities, think about what the software should and should not do, and how the software can better resist, tolerate and recover when under attack.
• Keep in mind that security is a risk management issue. The highest areas of vulnerabilityand risk need to be assessed and mitigated during each lifecycle phase. Risks and their priorities will change as the software is designed, developed and deployed. The implementation of these risk management practices depends on the characteristics of the software. For example, risk analysis and assessment for an integrated system have different requirements than assessing risks for a commercial product or an infrastructure component.

Practice selection and tailoring are specific to each organization and each project based on the objectives, constraints and criticality of the software under development.

Julia H. Allen is a senior member of the technical staff within the CERT(r) Program at the Software Engineering Institute (SEI), a unit of Carnegie Mellon University in Pittsburgh. Allen is engaged in developing and transitioning executive outreach programs in enterprise security and governance as well as conducting research in software security and assurance.

Editor's Note: This excerpt was printed with permission of Pearson Education from the book Software Security Engineering written by Allen, Julia H./ Barnum, Sean/ Ellison, Robert J./ McGraw, Gary/ Mead, Nancy R.