Security in SDLC versus Agile
Application Security Effort
SDLC has more security effort compared to Agile (Assal & Chiasson, 2018). This is because security is involved in several steps of SDLC and Agile; the security effort is mostly in the verification phase (Rindell et al., 2021). Therefore, software developed in SDLC goes through more security efforts, unlike software developed in Agile.
The Development Methodology
In Agile, both the developers and users are responsible for security because the security effort is in the verification phase (Rindell et al., 2021). To verify if the software works as expected, developers and users must work together. If the users point out an issue, the developers should work on solving the issue(s). In SDLC, developers are more responsible for software security because the effort is focused on stages that are developer duties (Assal & Chiasson, 2018). The stages include code analysis, code review, implementation, and post-development testing. So yes, the methodology affects who is responsible for security because security efforts are in different phases, hence, different responsibilities for different people.
The Frequency Of Security Activities
There are more security activities in SDLC than in Agile. However, Agile is a repetitive model, while SDLC is sequential (Rindell et al., 2021). Therefore, a stage in SDLC is most likely to be done once, but in Agile, a phase could be repeated until the end product is acceptable (Assal & Chiasson, 2018). If the verification phase in Agile is repeated several times, then security activities would be more than in SDLC.
When the Security Enters the Picture in Each Development Model
In Agile, security efforts are not introduced until the verification phase (Rindell et al., 2021). Accordingly, this means that security efforts are focused on the implementation part. However, in SDLC, the security efforts are in the implementation phase, as well as coding and post-development testing (Assal & Chiasson, 2018). Neither methodology focuses much on security efforts in the requirements and design phases.
References
Assal, H., & Chiasson, S. (2018). Security in the Software Development Lifecycle [Paper presentation]. Fourteenth Symposium on Usable Privacy and Security (SOUPS), Baltimore, MD. https://www.researchgate.net/publication/327417111_Security_in_the_Software_Development_Lifecycle
Rindell, K., Ruohonen, J., Holvitie, J., Hyrynsalmi, S., & Leppanen, V. (2021). Security in agile software development: A practitioner survey. Information and Software Technology, 131(2021), 1-13. Security in agile software development: A practitioner survey
ORDER A PLAGIARISM-FREE PAPER HERE
We’ll write everything from scratch
Question
Create a new thread:
How does the application security effort differ between developing software using the SDLC approach and Agile?
Does the development methodology affect who is responsible for security?
What about the frequency of security activities?
When does security enter the picture in each development model?