-
-
-
-
URL copied!
In my last post, “Security Training for the Development Team,” I shared the experience of building a security training program for the development team.
Today, I will cover another essential step of securing engineering: security requirements. After reading this blog, I hope you will have a better understanding and be able to improve your security processes by implementing the additional requirements you’ll find here from the beginning of the product engineering phase.
Understanding a system’s security and privacy requirements is critical to building a secure system. Therefore, security requirements must be updated regularly to reflect current requirements and the constant threat of landscape changes. Security requirements should also be defined along with the functional requirements, as this will help the design team to create a better system that can both cover these requirements and build a new security culture and mindset.
Below, we will discuss an agile development environment and how security requirements can be captured and tracked in different ways.
1. Security Epics And User Stories
A team can track security requirements similar to the functional and feature requirements in the form of epics and user stories.
Epics and user stories can document and track business-related security requirements like security requirements for policy/compliance, legal, contractual and regulatory requirements, or system functionalities, design levels like multi-factor authentication, logging, and tracing. These can be prioritized alongside other epics and user stories.
Security epics and user stories ensure security requirements are considered from the beginning, making the team fully aware of these requirements. The team can also tag these epics and user stories by tracking them separately across a security board.
2. Security Tasks
In addition to epics and user stories, a team can also track security requirements as part of the security tasks. Security tasks are more suitable for granular or implementation levels, for example, when a task is used to implement data encryption while capturing and storing PII data.
Security tasks ensure that security is not missed while implementing business features and functionalities.
3. Security Debt
Security tasks can also be captured and tracked through a function called security debt. Debt is those tasks that cannot be properly implemented because of the prioritization part of this list.
But as with technical debt, a team should be cautious when tracking security debt, as this can grow rapidly and become a significant risk if it is not taken care of within a reasonable time.
4. Operational Security Tasks
The team can also capture and track operational-related security tasks as part of their operational security tasks.
These tasks are typically not related to security requirements, meaning they are operational. Examples could include updating the development environment regularly, updating open-source libraries regularly (at least before each major release), resolving issues reported by SAST, etc.
5. Specialized Security Tasks
The engineering team can implement all of the above without any significant help from the security team.
But there are a few tasks that require a deep understanding of security. These can be captured and tracked through specialized security tasks such as the performance of threat modeling, PEN testing, environment hardening, etc.
Top Insights
Innovators and Laggards: The Technology Landscape of 2019
Digital TransformationPerspectiveAutomotiveCommunicationsConsumer and RetailFinancial ServicesHealthcareManufacturing and IndustrialMediaTechnologyBlog Categories
Let’s Work Together
Related Content
The “hype cycle” is about the hype—not the technology
The hype cycle has little to do with the merits of a particular technology. It simply has to do with the amount of publicity the technology has received. In particular, if the publicity jumps ahead of what the technology can immediately deliver, then the technology quickly gets labeled as “over hyped”. This is not the … Continue reading Security Requirements for the Development Team →
Learn more
5 Trends & Takeaways from Google Cloud Next
Executives, decision-makers, technical experts, and Google Cloud partners converged at Google Cloud Next to explore cutting-edge innovations and industry trends. GlobalLogic was there, speaking about modernization strategy and delivering a Cube talk on Intelligently Engineering the Next Gen AI Platform we are building for Hitachi. Among the buzz at GCN 2024, using GenAI for customer … Continue reading Security Requirements for the Development Team →
Learn more
Give yourself a promotion using GenAI
I think we’d all agree that getting promoted is desirable. Higher wages, better job title, greater impact, and perhaps more prestige. But it’s not without its problems. Like many engineers, I started out writing code. I was good at it, and customer demand increased for my services. I then started hiring other engineers and promoted … Continue reading Security Requirements for the Development Team →
Learn more
Share this page:
-
-
-
-
URL copied!