Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Microsoft, Juniper issue guidelines in coding consortium for safer applications

The task list is meant to guide Agile teams toward accomplishing goals that will lower risk of vulnerabilities

Article comments

The Software Assurance Forum for Excellence in Code (SAFECode) - an industry consortium consisting of major vendors like Microsoft, Juniper, Adobe, EMC, SAP, Siemens, Symantec and Nokia - has released guidelines to lower the risks of vulnerabilities that may worm their way in during the Agile software development process.

Agile is a framework for incremental software development by teams that work together in stages called sprints to develop the first iteration of code then revisit it regularly to refine the product based on new requirements and input from users.

SAFECode's new paper, "Practical Security Stories and Security Tasks for Agile Development Environments," presents Agile teams with a list of specific goals they may be trying to achieve at the outset and tasks necessary to achieve each one.

These tasks are refined at the end of each sprint in preparation for the next one, but they set Agile teams on a path that will lead to a safer end product, says Edward Bonvar, a principal senior software engineer at Symantec who participates in SAFECode. 

The paper lays down 36 goals Agile teams may wish to pursue while working on software products and is meant to supplement an earlier best practices paper written by the group. These goals are gleaned from the experiences of coding teams within SAFECode's members as effective ways to approach Agile coding.

Called stories, these specific goals are written in plain language and from a particular perspective. For example, one story reads: "As a(n) architect/developer, I want to ensure AND as [quality assurance], I want to verify that cross-site scripting attacks are prevented."

The story is accompanied by a set of tasks to accomplish this goal, each one marked with the category of team members who should work on each task. One task associated with the story in the example above is directed toward developers and testers and reads: "[D/T] When generating dynamic web pages, filter the input for any browser-executable content that is not intended (for example, from user-originated fields in a database). Consider all forms of input of content that might eventually be presented to and consumed by a browser, like events generated outside the system, log messages, arguments in a URL, form field values, etc. Perform this filtering at server-side, close to use."

Depending on how much is accomplished toward that goal after the first sprint, it may remain as a task for the next one or be refined to address new issues that crop up.

The task list is meant to guide Agile teams toward accomplishing goals that will lower risk of vulnerabilities, but not by setting down a rigid set of steps that may not be applicable to all projects.

"Incorporating security in Agile was a challenge," for SAFECode member companies, Bonvar says. "They decided to share their experiences, what they had success doing."



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *