Purpose-built secure software development frameworks
The aforementioned software development frameworks and models can be adapted to incorporate security provisions, but they're not inherently designed for security.
The following two SDLC frameworks take the current approach to software design to a higher level by incorporating risk and security elements.
BSA Framework for Secure Software
Developed by BSA | The Software Alliance and released in 2019, the BSA Framework for Secure Software is a risk-based and security-focused tool software developers, vendors and users can use to examine and analyze how software will perform in specific security situations. Software products and services are the primary focus of the framework, as opposed to traditional SDLC-type models and frameworks. What makes the framework unique is how it helps users ensure that security is factored into the development process and that the software, as written, produces the desired security capabilities and outcomes.
The framework's risk-based approach helps users and stakeholders identify specific security parameters required by their organization. BSA's framework is composed of a detailed matrix of the following:
NIST SP 800-218 (2022), SSDF Version 1.1
NIST introduced its secure SDLC framework in 2021. The Secure Software Development Framework (SSDF) introduces and recommends specific security-focused activities for each phase of the SDLC.
By integrating the recommended activities specified in the framework into the proper lifecycle phase, software developers can reduce security vulnerabilities in newly developed or updated software, lower the effect of security breaches, and identify possible causes of vulnerabilities to better prepare and prevent future breaches or attacks. SSDF includes a vocabulary of terms to facilitate communication among vendors and users.
A key message in the framework is the importance of introducing security issues and requirements as early as possible into the SDLC. Security can no longer be an afterthought. Rather, security should be a central component of any software development project.
SSDF is a matrix based on the following elements:
While traditional SDLC models can be adapted to accommodate security practices, the two secure software development frameworks provide detailed guidance on the security attributes organizations should consider when building secure software products.
