# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 3 Materials and Methods
### Security Issues and Measures for Each SDLC Phases  
Even with the usage of external perimeters like firewalls, proxies, intrusion detection systems, and antivirus software, most software cannot withstand security threats. The cause is that software inherently lacks security and has flaws that can be used in security assaults. These vulnerabilities are primarily brought about by specification, design, and coding errors that software engineers unintentionally introduce [4]. Security was regarded as a non-functional need in the SDLC because to the utilization of outsider perimeters up until this point [6]. Secure software, however, is software that is inherently resistant to attack [4]. These vulnerabilities which are mostly code and design flaws, go unreported by software experts. Software security must be built into the software in order to create one that is secure. Software can be made secure by maintaining the assets' non-repudiation, availability, confidentiality, and integrity, and assets, resources, and even the running programs themselves that the software generates, stores, processes, or sends.  
In the software development life cycle, security plays a very important role, and software security testing is an important means to achieve goal of SSDLC.  
The first phase of the SDLC involves identifying the need, purpose and scope of the software following which requirements proposed. At this phase, the identified risks that are used in developing the software requirements including the security requirements so that is ensured that threats and potential functionality and integration constraints considered in line with the requirements. The second phase of the SDLC involves designing the system based on the requirements. Identified risk can be used to support security analyses of the software. These risks may have impact on the architecture and design of the software. Security requirements were analysed, the security architecture were designed while functional and security tests completed.  
The third phase of the SDLC involves configuring, testing and verifying modules or software components for production. Risk management supports the assessment of the software by comparing software implementation against requirements and within the operational environment. Management of identified risks were decided before software was moved for operation. The software was integrated into the software environment, security controls were tested, and the accreditation was completed.  
The fourth phase of the SDLC involves deploying the software in the environment for modification via potential hardware and other (code) changes or additions as well as by changes to organisational practices. At this phase, risk management activities were performed in line with software being re-authorised and monitored for performance in a periodic process. The software is re-assessed when the IT has faced major changes in the operational environment such as new features were developed and tested, or new hardware is added or replaced. The software's operational readiness was reviewed, the system configuration was managed, and the process and procedures for monitoring are set up. The fifth phase of the SDLC involves moving the system for deployment in a real environment. At this phase, risk management activities are performed for disposable or replaceable software components so that disposal was performed properly, and that residual data was handled appropriately and migration to new system happens securely.