Fitting Security into Agile Software Development

Success of the software development process depends on its ability to transform its objectives into requirements, and implementing these into features and functionality. Security objectives in software development are increasingly converging with the business objectives, as requirements for privacy and the cost of security incidents call for more dependable software products. Development of secure software is accomplished by augmenting the software development process with specific security engineering activities. Security engineering, in contrast to the iterative and incremental software development processes, is characterized by sequential life cycle models: the security objectives are thus to be achieved by an approach in apparent conflict with the unaugmented software development processes. In this study, to identify the incompatibilities between the approaches, the security engineering activities from Microsoft SDL, the ISO Common Criteria and OWASP SAMM security engineering models are mapped into common agile software development processes, practices and artifacts. The mapping is done primarily from the point of view of achieving the security objectives set for the software engineering process: setting security requirements for design, the implementation of the security architecture and design, and the required security verification before releasing secure software through efficient software security development process towards secure software maintenance.