Adopt the NIST SSDF today
By: Chaitanya Kunthe
Tags: Cybersecurity, Ciso, Software Development

Adopt the NIST SSDF today

Simple. Extensive. Snaps right into your SDLC. What’s not to like?

Photo by Markus Spiske on Unsplash

“Insecure coding leads to software vulnerabilities”. We have heard this so often that we now believe it to be the only truth. Not True.

Most vulnerabilities are software related. However, they are not all caused by insecure coding. If I were to rephrase the earlier sentence, I would say — “Insecure coding also leads to software vulnerabilities”. The meaning changes immediately.

As software developers, you need to focus not just on writing secure code, but setting up a proper framework for secure software development. Yes, writing secure code is a big part of it, but do not forget other areas where vulnerabilities can be introduced into your precious software.

The platforms you choose may introduce vulnerabilities. The libraries that you use might have vulnerabilities. There are many areas in the software development life cycle that must be secured.

Focusing solely on secure coding is like protecting your house by focusing on choosing a pickproof lock and ignoring an open window.

This is where secure software developments frameworks come in handy. Someone has already done the hard part of thinking about the various aspects of software development and identified the steps to be taken.

There are many such frameworks:

However, once in a while, a framework comes along that is clear, concise and simply makes sense. The NIST SSDF is one of them. It focuses on the entire life cycle of software development and not just on secure coding.

Also, It will fit right into your agile approach.

What’s so great about the SSDF?

The NIST SSDF is a framework that fills a gap in the current approaches to security in software development.

If you are certified on frameworks like ISO 27001, you know the domain of “Security in development and support process”. It has objectives related to capturing security requirements of systems and security in the development and support process. The basics get covered. The devil, however, is in the detail. If you want your team to have processes and checklists for what secure libraries to use, when and how to reuse code, quick and effective vulnerability handling, then the SSDF has you covered.

Add to that the simple language and structure. Check this statement — use up to date versions of compilers and build tools. It is rare to find such simple language in the software development world. You are more likely to find a statement like — obsolete and deprecated versions of source code compilers, interpreters and packagers should be avoided. Even non technical personnel can reasonably interpret the system and get the required policies and processes rolling.

A third reason why this framework is so good is that it addresses all aspects of software development where vulnerabilities might be introduced.

Here’s a brief overview.

You can download the framework from the NIST website.

Structure

The SSDF is divided into 4 groups. They are not very cleverly named, but they reasonably convey the meaning.

The 4 areas of SSDF

Prepare the organisation (PO)

Think of this area as setting your goals, objectives and criteria and identifying who will do what. Do this at the organisation level — even if you are a software development house doing work for clients. After all, developing software that is secure is table stakes. If you are a software product organisation, then it is very simple for you to take this up at the organisation level.

Preparing the organisation (PO) is setting the stage for your secure software development. It involves writing down your security requirements, identifying the people responsible, etc. It also involves identifying the tools that you would use during the entire devops lifecycle. And finally, it includes listing down the security checks that your software would go through.

Prepare your organisation for secure software development

Protect Software (PS)

Where are you storing your source code? Who has access to it? How are you going to manage releases? Security of source code is the focal point of the PS area.

All the domains within PS, again, are organisation level domains.

It focuses on three core domains — protecting the software code within your organisation, ensuring integrity of releases and archiving and protecting versions.

Protect Software

Produce well secure software (PW)

This is the area where you focus on writing the code securely. It is the largest section of the NIST SSDF — rightly so. It involves areas like threat modelling, use of secure third party libraries, secure coding practices, build and compilation security, code testing and secure deployment.

These domains may have different implementations within your organisation. It depends on the type of application you are building as well as the architecture, chosen framework, etc. — not to mention business security requirements.

Produce well secure software

Respond to vulnerabilities (RV)

This area focuses on post deployment. Its main focus is on identifying vulnerabilities on a ongoing basis, remediating them and eliminating their root cause.

This can be either organisation wide or application specific. However, it makes sense to have one system that tracks bugs and vulnerabilities.

Respond to vulnerabilities

What now?

If you feel that your organisation could benefit from implementing this framework, download it right now, go through it in detail and identify areas where you are currently not implementing controls that you should be.

Initiate discussions within your organisation to identify the objectives that your secure software development framework would achieve. Document them. Then create policies and processes. You will need to create checklists for individual projects and even sprints, if you want to have a successful secure software development framework implemented in your organisation.

Armed with that, you can now begin your work. 😃