Security Development Lifecycle for Agile Development

Security Development Lifecycle for

Agile Development

Version 1.0

June 30, 2009

For the latest information, please see .

The information contained in this document represents the current view of Microsoft Corporation on

the issues discussed as of the date of publication. Because Microsoft must respond to changing

market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and

Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR

IMPLIED, IN THIS SUMMARY.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the

rights under copyright, no part of this document may be reproduced, stored in, or introduced into a

retrieval system, or transmitted in any form, by any means (electronic, mechanical, photocopying,

recording, or otherwise), or for any purpose, without the express written permission of Microsoft

Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property

rights covering subject matter in this document. Except as expressly provided in any written license

agreement from Microsoft, the furnishing of this document does not give you any license to these

patents, trademarks, copyrights, or other intellectual property.

Unless otherwise noted, the example companies, organizations, products, domain names, e-mail

addresses, logos, people, places, and events depicted herein are fictitious, and no association with any

real company, organization, product, domain name, e-mail address, logo, person, place, or event is

intended or should be inferred.

? 2009 Microsoft Corporation. All rights reserved.

Microsoft, ActiveX, Visual Basic, Visual C++, Visual Studio, and Windows are trademarks of the

Microsoft group of companies.

The names of actual companies and products mentioned herein may be the trademarks of their

respective owners.

Abstract

This document defines a way to embrace lightweight software security practices when using Agile

software development methods, such as Extreme Programming (XP) and Scrum. The goal is to meld the

proven Microsoft Security Development Lifecycle (SDL) with Agile methodologies in a way that maintains

the principles of both the Agile methods and the SDL process.

This document does not explain all the nuances of the SDL. To gain a deeper understanding of the SDL,

you can review the latest version at .

The intended audience for this document is development teams who want to build more secure

applications using Agile methods. No extensive SDL or Agile knowledge is assumed.

Security Development Lifecycle for Agile Development

1

Contents

Abstract ........................................................................................................................................................................ 1

Introduction .................................................................................................................................................................. 3

Melding the Agile and SDL Worlds ............................................................................................................................. 3

SDL-Agile Requirements ............................................................................................................................................. 3

Every-Sprint Requirements ........................................................................................................................................ 4

Bucket Requirements ................................................................................................................................................. 4

One-Time Requirements ............................................................................................................................................ 5

Constraints ................................................................................................................................................................. 6

Applying SDL Tasks to Sprints ................................................................................................................................... 7

Security Education ..................................................................................................................................................... 7

Tooling and Automation ............................................................................................................................................. 8

Threat Modeling: The Cornerstone of the SDL........................................................................................................... 8

Fuzz Testing............................................................................................................................................................... 9

Using a Spike to Analyze and Measure Unsecure Code in Bug Dense and ¡°At-Risk¡± Code ...................................... 9

Exceptions ............................................................................................................................................................... 10

Final Security Review ............................................................................................................................................... 10

SDL-Agile Example .................................................................................................................................................... 11

Appendix A: Every-Sprint Requirements ................................................................................................................. 13

Appendix B: Bucket Requirements .......................................................................................................................... 15

Bucket A: Security Verification ................................................................................................................................. 15

Bucket B: Design Review ......................................................................................................................................... 16

Bucket C: Response Plans ...................................................................................................................................... 17

Appendix C: SDL-Agile One-Time Requirements.................................................................................................... 18

Appendix D: High-Risk Code .................................................................................................................................... 19

Appendix E: Frequently Asked Questions ............................................................................................................... 20

Security Development Lifecycle for Agile Development

2

Introduction

Many software development organizations, including many product and online services groups within

Microsoft, use Agile software development and management methods to build their applications.

Historically, security has not been given the attention it needs when developing software with Agile

methods. Since Agile methods focus on rapidly creating features that satisfy customers¡¯ direct needs, and

security is a customer need, it¡¯s important that it not be overlooked. In today¡¯s highly interconnected

world, where there are strong regulatory and privacy requirements to protect private data, security must

be treated as a high priority.

There is a perception today that Agile methods do not create secure code, and, on further analysis, the

perception is reality. There is very little ¡°secure Agile¡± expertise available in the market today. This needs

to change. But the only way the perception and reality can change is by actively taking steps to integrate

security requirements into Agile development methods.

Microsoft has embarked on a set of software development process improvements called the Security

Development Lifecycle (SDL). The SDL has been shown to reduce the number of vulnerabilities in shipping

software by more than 50 percent. However, from an Agile viewpoint, the SDL is heavyweight because it

was designed primarily to help secure very large products, such as Windows? and Microsoft Office, both

of which have long development cycles.

If Agile practitioners are to adopt the SDL, two changes must be made. First, SDL additions to Agile

processes must be lean. This means that for each feature, the team does just enough SDL work for that

feature before working on the next one. Second, the development phases (design, implementation,

verification, and release) associated with the classic waterfall-style SDL do not apply to Agile and must be

reorganized into a more Agile-friendly format. To this end, the SDL team at Microsoft developed and put

into practice a streamlined approach that melds agile methods and security¡ªthe Security Development

Lifecycle for Agile Development (SDL-Agile).

Melding the Agile and SDL Worlds

With Agile release cycles taking as little as one week, there simply isn¡¯t enough time for teams to

complete all of the SDL requirements for every release. On the other hand, there are serious security

issues that the SDL is designed to address, and these issues simply can¡¯t be ignored for any release¡ªno

matter how small.

Integrating the two worlds is not as difficult as it might seem¡ªat its heart, the SDL defines tasks, and

these tasks can be mapped into an Agile development process. One benefit of the SDL is that it is

relatively artifact-free, which means there is little documentation overhead (with the notable exception of

threat models, which are discussed later in this document). It is possible to create artifacts if they are

needed, but this is generally not required in an Agile environment.

SDL-Agile Requirements

A workhorse of Agile development is the sprint, which is a short period of time (usually 15 to 60 days)

within which a set of features or stories are designed, developed, tested, and then potentially delivered to

customers. The list of features to add to a product is called the product backlog, and prior to a sprint

commencing, a list of features is selected from the product backlog and added to the sprint backlog. The

Security Development Lifecycle for Agile Development

3

SDL fits this metaphor perfectly¡ªSDL requirements are represented as tasks and added to the product

and sprint backlogs. These tasks are then selected by team members to complete. You can think of the

bite-sized SDL tasks added to the backlog as non-functional stories.

Every-Sprint Requirements

In order to fit the weighty SDL requirements into the svelte Agile framework, SDL-Agile places each SDL

requirement and recommendation into one of three categories defined by frequency of completion. The

first category consists of the SDL requirements that are so essential to security that no software should

ever be released without these requirements being met. This category is called the every-sprint category.

Whether a team¡¯s sprint is two weeks or two months long, every SDL requirement in the every-sprint

category must be completed in each and every sprint, or the sprint is deemed incomplete, and the

software cannot be released. This includes any release of the software to an external audience, whether

this is a box product release to manufacturing (RTM), online service release to Web (RTW), or alpha/beta

preview release.

Some examples of every-sprint requirements include:

?

Run analysis tools daily or per build (see the Tooling and Automation section later in this document).

?

Threat model all new features (see Threat Modeling: The Cornerstone of the SDL).

?

Ensure that each project member has completed at least one security training course in the past year

(see Security Education).

?

Use filtering and escaping libraries around all Web output.

?

Use only strong crypto in new code (AES, RSA, and SHA-256 or better).

For a complete list of the every-sprint requirements as followed by Microsoft SDL-Agile teams, see

Appendix A.

Bucket Requirements

The second category of SDL requirement consists of tasks that must be performed on a regular basis over

the lifetime of the project but that are not so critical as to be mandated for each sprint. This category is

called the bucket category and is subdivided into three separate buckets of related tasks. Currently there

are three buckets in the bucket category¡ªverification tasks (mostly fuzzers and other analysis tools),

design review tasks, and response planning tasks. Instead of completing all bucket requirements each

sprint, product teams must complete only one SDL requirement from each bucket of related tasks during

each sprint. The table below contains only a sampling of the tasks for each bucket. To see a complete list

of all tasks for all three buckets, consult Appendix B: Bucket Requirements.

Verification Tasks

Design Review

Response Planning

ActiveX? fuzzing

Conduct a privacy review

Create privacy support documents

Attack surface analysis

Review crypto design

Update security response contacts

Binary analysis (BinScope)

Assembly naming and APTCA

Update network down plan

File fuzz testing

User Account Control

Define/update security bug bar

Table 1. Example of bucket categories. For a complete list of bucket items, see Appendix B: Bucket

Requirements.

Security Development Lifecycle for Agile Development

4

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download