Building security into your software-development lifecycle

In the beginning, software vendors thought that they could handle security vulnerabilities as they handle software bugs using their regular support process. Unfortunately, it's not so easy. Software security vulnerabilities are not like other software defects. Vulnerabilities have a timeline and they are not simply triggered by random user events.

Once attackers know how to exploit a vulnerability, they will actively attack vulnerable computers until it is patched. This “window of vulnerability” has gotten smaller with auto-update and patch-management solutions, but attackers have also gotten quicker at delivering new exploits with toolkits and bot networks. Having a window of vulnerability at all, however, is the problem.

The software industry's manufacturing process is very different from the one used by other high-tech industries such as semiconductors or aircraft engines, which strive for six sigma or 3.4 defects per one million opportunities. The profitability of the software industry had benefitted in the past from its ability to quickly release imperfect software and to fix the biggest problems later in the field. Now everything has changed, with the knowledge that motivated attackers can find and exploit software security vulnerabilities before they are patched. “Ship, pray and patch,” as a development methodology, is dead.