# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 5 Discussion  
This study aimed to identify the risk factors connected with each system development life cycle phase's security evaluation (SDLC). On the basis of an analysis of comparable works, the study first identified a number of risk variables. To determine the most significant risk factors for determining the ASR at each stage in the process software development, questionnaires were given to developers based on these risk factors. After the questionnaires were distributed, the developers identified certain risk indicators, and based on their response, every risk factor was given a priority. Prioritization was given to the risk factors as high, medium, and low. The 100% of respondents approved the use of the identified risk factors, the high significance risk considerations were taken into consideration. The statistical non-parametric test was used to investigate the mid-priority risk factors and look at the variation in replies based on the setting that each respondent belonged to, and the areas of expertise of the chosen respondents. Since the developers did not choose any of the low-priority risk categories, they were all not taken into account. The results of the study showed that about 93 initial risk factors were initially identified. Among these, 11 risk factors were identified and validated for the requirement analysis and problem identification phase, 8 risk factors were identified and validated for the system design phase, 9 risk factors were identified for the implementation and unit testing phase,4 risk factors were identified and verified during the phase of system integration and testing, while 6 risk factors were found been approved for the SDLC's operation and maintenance phase. The results showed that using a value of 0 for Yes and 1 for No, a scoring mechanism was created for each phase of the SDLC and was used to determine the security risk classes to be evaluated based on the total score of responses provided by the user. Using the total score, a specific interval was created for Low Risk, Moderate Risk, and High Risk while allocating a score of 0 for No risk cases. The results showed that using a triangular membership function, and the SRA model was formulated by the use of two triangle membership functions with centers of 0 and 1 for each risk factor's corresponding Yes and No answers. while for the output of the security risk assessment, four triangle membership functions with centers of 0, 1, 2, and 3 were used for No risk, Low risk, Moderate risk, and High risk respectively. The results of the distribution of the security risk assessments made by the respondents showed some observations. Among all the phases of SDLC assessed, it was observed that the requirements phase was the only phase without high security risk assessed however it was observed that the assessment of responses from General, SIDMACH and PyCOM-NG revealed responses that had high security risk following the assessments. This study shows how proposed model can be used to significantly identify the risk factors in SDLC phases and optimize the prediction of quality attributes in software. To be able to pinpoint the risks relevant to each stage of the SDLC, the risk factors that had been gathered were put to the test in each phase. Findings revealed that identify the risk factors connected to each SDLC phase's security evaluation can increase the software products quality, reliability, portability and usability. Identify the software development risk factor will also increase the software products reliability, functionality, efficiency and maintainability influences that will affect the overall software quality performance most. Hence, users of software systems should place importance to risk factors identity in each stage of SDLC of software products quality attributes based on how relevant the attributes are for the success of the organization. Software developers ought to employ test driven approaches during software development in order to minimize error.