News headlines abound with stories of well-known companies falling victim to cyberattacks and data breaches. But there’s a far bigger problem than the headlines would lead you to believe. It’s a problem that is part of the approach that has, so far, been taken to software development, and one that is leaving tiny imperfections deep inside the infrastructure of organizations across the world.
Typically, software development follows a set process: the software development life cycle (SDLC). It’s a best-practice plan that’s been adapted over the years and dictates how software should be developed, maintained, and updated. Historically, security was an afterthought throughout the process until a few years ago when an additional “S”: for “secure” was added, and those in DevOps found themselves with a new buzzword — secure software development life cycle, or SSDLC — and adopted manual security processes as part of the life cycle. But simply adding the S, without making any changes of the process, meant that code testing remained the priority instead of building in a specific security review of the code.
Read why Leigh-Anne Galloway, Cyber Security Resilience Lead at Positive Technologies, thinks that software security shouldn’t be an afterthought and why the secure software development life cycle deserves a fresh look on DarkReading.