Security best practices in software development

Every type of business – from small enterprises to global giants – across every type of sector can be vulnerable to cyberthreats, data breaches, and security flaws. And, because businesses know the cost of software security incidents and other security threats, global spending on information security – including network security equipment, infrastructure protection, and security services – is expected to reach $90 billion this year.

Many organisations are turning to DevSecOps teams to protect their systems, assets, and sensitive information. As defined by AWS, DevSecOps (Development, Security, Operations) is ‘the practice of integrating security testing at every stage of the software development process. It includes tools and processes that encourage collaboration between developers, security specialists, and operation teams to build software that is both efficient and secure.’

What are the top security threats in software development?

Software security threats – and the hackers behind them – constantly evolve in approach, often growing more sophisticated and harder to detect. Here are the findings from the latest edition of OWASP’s top 10 web application security risks:

Broken access control – inappropriately permissive access, together with poor role-based access control (RBAC), increases attack surfaces by enabling users to access data or perform actions which they are not authorised to
Cryptographic failures – weak or missing encryption of sensitive data
Injection – such as SQL injection and command injection – occur when untrusted data is transmitted as part of a query or command
Insecure design – includes any weaknesses or flaws in the software architecture or design that increases security risks and security vulnerabilities
Security misconfiguration – for example, open ports, enabling unnecessary features, and default credentials – creates potential vulnerabilities
Vulnerable and outdated components – third-party components, frameworks, or libraries that aren’t patched or updated can pose security issues
Identification and authentication failures – poorly implemented authentication – such as weak session IDs and session expiration – enables cybercriminals to gain unauthorised access
Software and data integrity failures – security risks increase when software or data can be manipulated, corrupted, or modified in an unauthorised manner
Security logging and monitoring failures – these can often result in security breaches and threats going under the radar
Server-side request forgery (SSRF) – hackers manipulate servers into making unauthorised requests, generally to access internal services or systems.

Of course, there are more beyond these – including insider threats, API vulnerabilities, cross-site request forgery (CSRF), cross-site scripting (XSS), insecure deserialisation, typosquatting, and cloud security issues.

How can developers implement security best practices in the software development process?

Proactive management of security threats enables developers to design and build more robust, secure software. In turn, this reduces the risk of software exploitation and damage resulting from security threats.

IBM believe DevSecOps should be a ‘natural incorporation of security controls in all development, delivery, and operational processes.’ They list some of the key secure software development best practices – to achieve a secure SDLC – as:

traceability, auditability, and visibility. Track configuration items across the SDLC to where requirements are implemented in code to support compliance, bug reduction, code maintainability, and secure app development. Audit technical, procedural, and administrative security controls to ensure compliance, and use a secure monitoring system across the project lifecycle to check for real-time attacks and changes.
culture. Leadership should communicate the importance of security, individual and collective responsibility, and product and workflow ownership.
security awareness and education. Developers need to understand threat models, compliance checks and have a working knowledge of how to measure risks, exposure, and implement security controls. However, organisation-wide awareness of the basic tenets of software and application security, and the company’s security posture, is vital – from the Open Web Application Security Project (OWASP) Top 10 to security engineering practices. It ensures everyone is operating and working to the same standards and minimises compliance and security issues.

It also means that everyone involved in the SDLC – from engineers and programmers to project leads and web designers – must adhere to the Secure Software Development Framework.

What is the Secure Software Development Framework?

NIST’s Secure Software Development Framework (SSDF) is a core set of high-level secure software development practices for secure software development lifecycle (SDLC) integration. It aims to:

reduce vulnerabilities
address root causes to prevent recurrence
mitigate the impact of unaddressed or undetected threats.

Following the SSDF recommendations – which include actions such as ‘define and use criteria for software security checks’ (1.4), ‘protect all forms of code from unauthorised access and tampering’ (2.1), ‘archive and protect each software release’ (2.3), and ‘assess, prioritise, and remediate vulnerabilities’ (4.2) – helps developers to create more-secure software that is less vulnerable to exploitation.

In practice, example actions suggested by the SSDF may include: threat modelling; using secure design patterns; following appropriate frameworks, such as coding guidelines; penetration testing; robust access control; input validation; and incident response planning.

What are some of the best security tools available to software development teams?

Software developers must practise security and vigilance from design to deployment. Fortunately, there are plenty of cutting-edge tools out there to support the creation of secure software products.

Here are just a handful of examples of popular security tools:

Static Application Security Testing (SAST) tools that analyse source code without executing the application, including SonarQube and Checkmarx
Penetration testing tools that use threat modelling to simulate attacks by manually exploiting applications, including Wireshark and Metasploit
Dynamic Application Security Testing (DAST) tools that test running applications through real-world threat simulations, including OWASP ZAP and Acunetix
Collaboration and code reviews tools that aim to spot security risks early in the SDLC, including GitLab and Phabricator
Software Composition Analysis (SCA) and dependency scanner tools that examine third-party dependences and open-source libraries to identify vulnerabilities, including Snyk and Dependabot
Interactive Application Security Testing (IAST) tools that identify risks in a code’s execution path, including Seeker by Synopsys and Contrast Security.

Implement secure development practices in your software systems

What’s your development environment like? Do you know the security requirements and mitigation techniques to minimise cyberattacks? Are you aware of secure coding practices?

Gain critical and highly sought-after skills in computing – including DevOps and cybersecurity – with City St George's online MSc Computer Science programme. Designed to provide the expertise and tools to excel in computer science careers and ideal for those with no background in the subject. Our flexible, 100%-online, self-paced master’s course is the ideal next step in your career. You’ll study programming and coding, web technologies, artificial intelligence, system design, software engineering, machine learning and automation, data analytics, web application security measures, and much more.