What is Secure Software Development?
Secure Software Development refers to the process of designing, coding, testing and deploying software with built-in security controls to minimize vulnerabilities and reduce the risk of exploitation. Secure Software Development integrates secure practices throughout the Software Development Lifecycle (SDLC), rather than as an afterthought.
Executive Order (EO) 14028 requires organizations to adopt Secure Software Development Practices (SSDP). EO 14028 Section 4e contains ten (10) subsections, each of which specifies actions or outcomes for software producers, such as Commercial-Off-The-Shelf (COTS) product vendors, Government-Off-The-Shelf (GOTS) software developers, contractors, and other custom software developers.
Accordingly, Secure Software Development Practices (SSDP) should be integrated throughout software life cycles for three (3) reasons:
- To reduce the number of vulnerabilities in released software;
- To reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities; and
- To address the root causes of vulnerabilities to prevent recurrences.
NIST SP 800-218 addresses EO 14028 Section 4e from a software producer viewpoint. The software producers are the ones who implement SSDF practices. EO 14028 Section 4k explains that federal agencies will need to comply with NIST guidelines. In this context, federal agencies are software purchasers, not software producers, so additional guidance from the US Government is needed to address EO 14028 Section 4e from a software purchaser viewpoint. However, when a federal agency (purchaser) acquires software or a product containing software, the agency is required to receive attestation from the software producer that the software’s development complies with US Government-specified secure software development practices.
By embedding security into development practices, secure software development practices help organizations reduce risks like injection attacks, buffer overflows and unauthorized access, thus protecting data integrity, confidentiality and availability.