This document discusses integrating security activities into agile development processes. It outlines common security practices from frameworks like Microsoft SDL, Cigital Touchpoints, Common Criteria, and CLASP. The document presents a flow chart for integrating security into each stage of agile development, from planning and requirements to implementation and release. The goal is to leverage security best practices while maintaining agility.

1. Integrating
of Security
Activates in
Agile
Process
PRESENTER: ZUBAIR RAHIM
1

2. Presentation Outline 2
 What is security
 Why We need security
 Agile development
 What is Agile Security
 Agile Security Manifesto
 Integration of Security in Agile Development Method
 Integration Method

3. What is cyber security 3
 Cyber security or IT security, is the protection of
computer systems from the theft or damage to
their hardware, software or information, as well as
from disruption or misdirection of the services
they provide. (Wikipedia)
 It covers all aspects of ensuring the protection of
citizens, businesses and critical infrastructures
from threats that arise from their use of
computers and the Internet.
 CIA


4. Why We need security 4
MORE THAN 2.5 BILLION RECORDS
STOLEN 2017 ...
The 2003 loss estimates by these
firms range from $226 billion.

5. Agile Development
SUMMARY.JPG

6. Agile Security
6
 Today large parts of the
industry have shifted
software development
from a former waterfall
model to a more flexible
agile software
development process.
 So the industry experience,
identify what practices
from mature SE processes
are easily integrated and
also provide a benefit to
agile projects.

7. Cigital’s “Agile Security Manifesto” 7
Rely on good
developers and
testers over security
specialists
01
Implement secure
architecture over
adding security
features afterwards
02
Continuously
improve security over
completely changing
processes
03
Focus on fixing
software over finding
bugs
04

8. Integration of Security in
Agile Development
Method
8
 The four highly profile SE
processes
1. Microsoft SDL,
2. Cigital Touchpoints,
3. Common Criteria and
4. CLASP are investigated.
 Based on these investigations a
total of 41 security activities are
obtained.

9. 9

10. Cigatel Touchpoints 10
 lightweight SE process

11. Common Criteria
 International set of guidelines and specifications developed for evaluating
information security products.
 ISO certified
 Requirements
 Security Requirements
 Agree on definitions
 Design
 Risk Analyses
 Critical Assets
 UMLSec
 Requirements Inspection
 Release
 Repository Improvement
11

12. CLASP
12
 Comprehesive,
Lightweight Application
Security Process

13. Comparison of
secure software
development
standards and
models
13

14. Integration Method
 It is good to use these security activities for a secure software
development but may be with the integration of some heavy weight
activities may lead to loss of agility of a process. To handle the issue of
Integration of agile and security issue a flow chart is introduce.
14

15. 15

16. 16