Software Applications: Security Lifecycle Threats

You have been tasked with the design, development, and deployment of a new application, and there is more involved than just writing some code and testing it. How do we make sure that we have included security thinking throughout the entire product lifecycle—from concept to design to development, testing, and deployment? And what happens when this product is now nearing end of life—how do we make sure that we maintain its security posture even if we are no longer actively developing new features? What about all that data that has been collected by the product from users and customers? How do you know if you can handle a data breach or a cybersecurity compromise? How do you continue to protect the data your application processes and keep your application available and secure, and how do you prove this to your customers? How do you present- and future-proof against emerging technologies, regulations and industry trends? How do you make sure that you are set up to protect against threats from emerging technologies including machine learning/artificial intelligence (AI) and quantum computing? We address regulations and enforcement actions, including the United States President's Executive Order (EO) 14028 on Improving the Nation's Cybersecurity, the Cybersecurity and Infrastructure Agency's (CISA's) Secure by Design pledge, the US Securities and Exchange Commission guidelines on cybersecurity response, and global privacy regulations. The net is that you can be sure that whatever you do today may well not be enough to protect you tomorrow. In this course, we take a fictional product through the entire secure development lifecycle and explore how we think about and embed security into every phase, including those phases where security has traditionally been an afterthought. You apply these concepts—and tradeoffs—as you create and take your own software product through its end-to-end lifecycle. Threats and things to pay attention to include discussions drawn from the news (sadly there are always on-point things in the cybersecurity news that we can use as the basis of discussion), as well as CISA's Zero Trust Maturity Model, Secure by Design requirements, guidelines for secure AI system development, CISA's Known Exploitable Vulnerability (KEV) lists, threat modeling, risk management concepts, and whatever is topical at the time in the news.