Given a choice, every organization wants to provide web sites and applications from development of Web applications all the way through the life cycle of software development. But since this is a challenge to achieve? The answer is in the process (or lack thereof) that is in place.

Although separate and special security assessments of web applications will certainly help improve the security of the site or web application, after all, is settled, changes in applications and newfound vulnerabilities mean new security problems arise. So, if you put in place security controls, as well as continuous quality control throughout the life cycle of software development, from initial development through application of production web, you can never achieve a high level of security, of course, it is necessary to keep the system safe from attack – and the cost associated with fixing security weaknesses continue to be high.

The first two articles we discussed many important elements that you need to know to perform safety assessments of web applications and how to fix this vulnerability assessment found. And if your organization is like most, the first two assessments of web applications is a nightmare: low susceptibility rim, medium and high are found and must be corrected by using the Web application development. This process requires that decisions are made about how to solve complex applications as quickly as possible, without prejudice to the system at work, or delay the application starts.

But the assessment is the first web-based applications, while painful, provides a wonderful learning experience to improve the software development life cycle. This article describes how to enable organizational controls in place to make this process as simple as possible and is an integral part of your web application development efforts. This brief review of the quality assurance processes and technologies needed to start developing applications reliably as possible from the start and keep them that way. Not surprisingly, more. No more delay deployment.

Make sure that the Web application development: people, processes and technology

Create highly secure applications began in the early stages of the life cycle of software development with the developer. That is why security applications embed knowledge through training, development of web applications is one of the first things that you want to do. Not only do you want your developers armed with the latest knowledge on how to write secure code – and how attackers exploit weaknesses – but I want them to know how important (and far more effective) is to consider Security is “the beginning. This awareness should not end with web application development team. This should include all those who played a role in the life cycle of software development: quality and security testing team, who need to know how to identify potential weaknesses security and IT management team, who need to understand how to invest organizational resources more effectively to develop security applications, and how to assess the critical technologies such as scanners, the successful application of Web security, Web application firewall, and set of tools for quality control.

Of awareness throughout the development lifecycle of web applications, built one of the most important controls necessary to ensure the security of web applications. Although training is required, you can not rely on it to build the system safely. That’s why training should be strengthened further controls and technologies. You must begin to implement the elements of the life cycle of software development, which is safe, or SDLC.

Secure important element in the software development life cycle

To ensure the development of the software life cycle shall have policies and procedures to consider – and implement – to provide web application development, from conception through functional and technical requirements definition, design, coding, testing, quality, and, living in a real application. Developers must be trained to incorporate security best practices and checklists in their work: they tested their filtering database queries, or verify the proper handling input? This application was designed to be compatible with best practice programming? This application will abide by rules such as HIPAA and PCI DSS? Putting these types of procedures that will significantly enhance security during web application development process. After the developer controls the input field and search for the most common programming errors, such as written statements and make an assessment of future applications to flow much more smoothly.

While developers must test and evaluate the safety of their use are being developed, the next most important test of the process of software development life cycle comes after the Web application development has been completed. This is when all the application or module, ready for shipment to the stage of formal experiments to be performed to ensure quality and safety adviser. And during the life cycle phases of software development and quality testers, in addition to its traditional tasks, that performance and functional requirements are satisfied, pay attention to potential security problems.

The company made a mistake at this stage does not include members of the IT security team in the process. And, “We believe that computer security should have input throughout the life cycle of software development, fearing that the security problems in the region after the process of developing web applications – and what may be a small problem right now is a big problem.

Establishing such a process difficult job, and it may seem expensive at first glance. But the reality is that the record could be enormous: Your application will be safer, and safety assessment of the future, you’ll feel like a fire drill. There is a model of software development life cycle and techniques that can help you directly, for example, an application Security Assurance Program (ASAP), which raises a number of guidelines in place to build a secure code, including the Executive’s commitment to the security account from the outset application development Web-based applications and metrics for coding and process improvements over time. A good introduction to the software development lifecycle security Michael Howard and Steve Lipner (Microsoft Press, 2006).

As technology allows you to implement and maintain a secure SDLC

Human nature is what it is, people tend to slip back into their old sloppy way, if the new behavior (software development life cycle process we mentioned above) does not apply. That’s where technology can play a role. Not only the right tools to automate and ensure the safety assessment process of coding, but also can help keep it on the basis of development of web applications is required for success.

As mentioned in the first part of this series, at least, you’ll need a web application security scanner to assess your custom business and you buy the software. Depending on the size of your web application development team, and how many applications you are running at any given time, you will need to consider other tools that will enhance the process of software development life cycle. For example, tools, and quality assurance are available that integrate directly into application performance and quality control programs that already use a lot of organizations such as IBM and HP. With the integration of safety and quality of performance testing, quality assurance team can manage both functional testing and security from a single platform.

Basic enact (Keep It Simple, but in the early days)

Now that safety training on site, and you have a consistent, web application development methodology that safely, as well as assessment tools and development needs is a good time to start measuring your progress.

First, all changes in the life cycle of software development you will find it annoying and time consuming. Thus, executives and managers, and Web application development team and auditors, will certainly want to see the results of all new jobs that have been posted. Everyone will want the parameters and initial conditions: our software more secure? They are the developers coding better? The only way to answer these questions to begin to measure progress. But, at the very beginning not to fall into the trap of measuring too much.

A few days before the release of the software life cycle development process in place, we strongly recommend that you keep these simple steps. Not overloaded with too many types of monitoring vulnerabilities. In fact, you probably do not want to track and groping with each class of vulnerabilities as well. We’ve seen this mistake many times, companies are trying to fix the vulnerabilities found in every part of the software development life cycle of the Big Bang. Then, at the end of the year, finishing with a dozen truly vulnerable applications, but money is not there to fix things that need to be resolved. They end up scrambling, depression, and not in place. This is not the way to do it.

That is why, at the very beginning, we learn that a significant – and affordable – approach to Web application development process to determine which is the vulnerability of the most common and serious. If you enter a SQL-injection or logical errors, which can provide unauthorized access to applications, then this is your initial goal. Select the most important vulnerabilities that will be essential, in accordance with the assessment and the nature and business systems. This vulnerability will be submitted to be tracked during their march toward extinction (at least in the appendix).

After the development of Web applications, the team used for the formation of certain classes of vulnerabilities, you can add the next most recent (or two) to a mixture of vulnerability. Slowing the addition of a new class of vulnerabilities in the formal process of software development life cycle, you will be able to solve any problems or kinks in the process. And your team to develop web-based applications are becoming more accustomed to the process. There will be big hits, and over the months and years, you will see a significant improvement over the first reference value.

Placing important elements of management and technology described in this article are currently on the way to develop web applications that are always protected. Your gift will be the process of software development life cycle, which works much more smoothly and efficiently, you catch the problem early in the design process, so that the rules of the audit will be more fluid. And we have significantly reduced the possibility of a successful attack against the website.