Project Managers: Tactical ways to Push Testing

So, in my previous post, I talked about some of the high level things that you, as the Project Manager, need to be thinking about, as it relates to testing, when managing your projects.  In this post, I'm going to step down in to the tactical.  Specific things that you can begin to push within your projects and my recommendations for who should shoulder the responsibility.  These recommendations are based off of things that I've seen work in my current environment as well as things that I've seen work in various other organizations.

Now, before we dive in, a word of caution.  You need to evaluate what I'm saying and throw it up against the reality of the environment within which you work.  Some of what I say will work, some of what I say would probably spin heads within your organization.  Take what works for you and throw out the rest.  We're currently reevaluating some of the test strategies that are used within my teams and six months from now, I may have a different take on the subject.  My biggest concern is ensuring that we put enough thought in to the process to allow less experienced team members to be successful when working with unfamiliar subsystems or product features.

And, with that said, it's time to dig into the details and talk about things that I've seen work - note for those readers willing, I'd love to get feedback from others on what they are seeing work/not work in their environments.

First up, what are your end users (or the team members representing the end users) doing to drive the quality initiative?  These are the folks that are creating the user stories or requirements for the products that you're building.  Are they being held accountable at the start of the process to define what success means?  Are they telling you up front what they will do when performing user acceptance testing?  If not, it's time to sit down and have a conversation.  Why do they feel comfortable telling you what to build if they can't tell you how they will know it is right?  Specifically, what are the conditions and scenarios that they will use to validate that the functionality delivered is acting properly and producing the correct results?

1. What set of information needs to exist within the system to allow them to create the scenarios that they will use to test the requested functionality?  What specific elements of data will be used in the testing - both from a positive and negative test perspective?
2. What business logic is being used to assess whether the outcome is valid?  What will change within current processes?
3. Ultimately, what does success mean to them?  How will they know that what you've delivered works or doesn't work?

Now, ask yourself, if these do not exist prior to the design and development of the solution, how will the team know that the proposed solution will actually solve the problem?  This function must be driven by the end users (or those team members representing the end users).  They can collaborate with others on the team, including business analysts, technical team members and dedicated testers.  But, ownership of the acceptance test plan must fall on the shoulders of the end users.

One of the things that I like to do once the users have defined their needs and the design phase is underway, is to have the technical subject matter experts (SME's) begin to identify high level integration test objectives.  This is built at the same time that the technical design is being worked and is a very brief document outlining the gotchas that the development teams need to be aware of when developing and exercising the new systems/features.  This is intentionally kept very high level - usually just descriptions of each item that will need to be fleshed out in later stages.

1. Identify touch points between various sub-systems that will need to be tested.
2. Identify data replication strategies that will be used and that will need to be tested.
3. Identify data transformation strategies that will be used and that will need to be tested.
4. Identify services that will be relied on that will need to be tested.

This acts as a roadmap for the entire technical team.  It should be a roadmap used to identify data validation and functional validation.  It can be used by those that may be unfamiliar with specific subsystems to gain a further understanding of the interrelationships between the various subsystems and external/internal services.  The IT SME's own this high level integration test plan and pass it along to others in the process.

As we dive down in to the detail design - several things begin to happen.  First, the development team begins to flesh out the high level integration test strategy and it becomes the Integration Test Plan.  This document details the specific actions that will be used to test the touch points previously identified and should include the data and functional validation - data should be traceable throughout the system with the end points being validated.  This includes identifying the specific data elements that will be used to perform the tests as well as the expected positive/negative results.  While driven by individual development team members, the plan will be reviewed and validated by the Technical Leads.

Additionally, the individual development team members begin to identify their individual Unit Test strategies.  Each functional unit of code being created or modified needs to be tested to ensure that it is performing to spec prior to moving in to integration testing.  I believe in the paradigm that the tests should actually be created prior to the code being written, but I've seen development teams be successful using several different paradigms - so I won't harp on it.  The individual developers own this and are responsible for ensuring that they develop clean code.

Once the developers have been able to execute their individual Unit Tests, then they work together and move in to pre-Integration Test planning.  This time is spent ensuring that the necessary data has been identified and created/setup, that the configuration changes needed to the system and supporting sub-systems have been applied, that the network configuration changes needed to open ports to talk to internal/external services have been applied, and that all of this has been documented for production.  This particular block of activity is owned by the Development Team and the Technical Leads.  Infrastructure Teams may support the activity, but the Development Team and Technical Leads should ensure the configuration is complete and documented for the Implementation Plan.

Now we step in to Integration Testing - executing the plan that was documented earlier.  It is inevitable that something will have been missed - but that is what this stage is for, to find the bumps before you move your changes into the quality assurance (QA) and production environment.  Here you will find the missing data elements or calls to services/api's that work differently than documented.  You will uncover the fact that replication strategy for data you rely on wasn't documented properly and the underlying data you were expecting to see doesn't exist.  All sorts of unknowns will surface and you'll spend time playing whack-a-mole to clean it all up to a point where you believe it is functional.  The Development Team and the Tech Leads own this piece of the puzzle and work to ensure that all of the individual pieces come together and work as a whole. 

Now, let's take a few minutes to talk about Regression Testing.  I'm actually in the midst of transitioning our teams form the old style of moving code in to QA and then running a full regression test of the code along with new function/feature testing to a model where the code is built nightly and then the suite of regression tests is run when the build has finished.  This has been a tectonic shift for the teams in that the developers are getting daily feedback on code that has been checked in to the repository and we actually are building up a set of statistics that show us the overall state of the code.  I can now walk in on a daily basis and see the various package builds, number of tests being executed and the success/failure rate - along with a whole suite of statistics on coverage and severity of the failures.  Benefit number one - immediate feedback to the development team while the code is still fresh in their minds.  If we need to change something due to a failing test, the developer doesn't need to spend time remembering what changes were made.  Benefit number two - reduction of effort by our QA Team Members to get code through the testing process - their focus is on new feature/function testing, not regression testing.  Benefit number three - the developers have more buy-in on the testing process and begin to have a better understanding of the underlying data.  The Development Team is responsible for the Regression Testing and must review the results with QA to validate that the code is ready to move in to QA Testing.

QA Testing is focused on the new features/functionality to ensure that they are operating within defined constraints.  Here is where I want to hit the system hard with positive and negative testing associated with the new features/functionality being introduced within the overall system.  What happens where certain pieces of data are missing from messages exchanged between subsystems?  What happens when a user forgets to input data?  What happens when a web service that we are relying on isn't available?  What happens when the system thinks everything processed fine?  I will also want to take a look at load testing on some system to ensure that we are staying within expected SLA's.  This testing is the responsibility of the QA Team with input from the Development Team, Tech Leads and support from the Infrastructure Teams.

As  part of the work that is being done during QA Testing - we should also work with those team members representing the end users to execute the User Acceptance Tests (UATs).  This should tie all the way back to the beginning stages of the project where the business teams defined the success criteria of the effort and began building the definition of their UATs.  During the entire project, these high level UATs should have been fleshed out and reviewed to ensure that they align with the final requirements of the project.  QA and the User Teams should jointly execute and review the results of the associated UATs and prepare to sign off and give final authorization to move the code in to production.

As a Project Manager, you need to assign tasks to cover these activities within your overall project plan.  More importantly, you need to be following up with the responsible parties at various stages of the lifecycle to ensure that they are not being ignored.  Your organization may hold different team members responsible for the specific activities outlined.  They may also skip some of the items outlined above.  However, you need to ensure you are covering enough of the pieces to confirm that the system being built will satisfy the requirements originally identified at the beginning of the overall effort.

Well, we've reached the end of the discussion today.  I hope that you've found some of what I've discussed useful and that you're able to take pieces back in to your organization.  Feel free to share and let me know your thoughts on what has been presented and let me know what works in your organization.

Tags: SDLC, Software Development Lifecycle,  Project Lifecycle, Project, Manager, Development, Paradigm, Security, Secure Development Lifecycle, Communication, QA, Quality Assurance, Testing

For more information on David L. Collison: LinkedIn Profile

Project Managers, Bake Testing in to all of your Projects!

Well, this week I'm going to jump back in on the topic of quality - more importantly the need to build it in from the start.  This is a topic that many teams struggle with - how much testing is enough?  When do you call it good enough to move code in to production and celebrate success?

While I can't give you a definitive answer, it is important for you to look at each project and assess the risk of failure.  More importantly, you need to look at the various functional areas and ask yourself - what if there is an error, what will the impact be?  How will the application be used?  What is the audience?  What if this error is impacting one user?  What if this error is impacting multiple users?  Can downstream processes within the application - or dependent applications - continue to operate?

One of the questions that I've been asked by various developers - why are you making me do all this testing?  Isn't that the job of QA (Quality Assurance)?  Well, I hate to burst your bubble, but everyone is responsible for the quality of the end product.  Depending on the structure of the overall team involved in the project, the level of effort of the developers dials up or down.  If the organization has a strong QA Team, the developers may only be responsible for unit testing and some level of integration testing.  In other organizations, development may be responsible for everything up to and including user acceptance testing.  In web facing projects, business representatives may be integrated in to the Agile team and test directly with the developers - with the developers making changes on the spot.

I'm not going to try and convince you to pick one methodology or paradigm over another.  Each organization is unique and your organization has built the test structure that is being used for some set of reasons.  What I am going to do is explain some of the things that need to be done along the way - I can tell you who within the project I think is responsible, but this probably won't match up with your organization.  (I'll let you in on a little secret - it probably won't even match up with the way that my teams handle testing.  We're reworking how and who performs testing, so some of this is still up in the air as I write this blog entry.)

Whew, now that we've laid the ground work, let's dig in to the details and see if we can make some progress. Regardless of what methodology that you follow to develop software - the quality equation must be dealt with at the beginning of the project and must touch through all of the parts of your lifecycle to ensure that you're providing the highest quality software in to the production environment.  This is just as true in an Agile environment as it is within a waterfall environment.

So, let's touch base on some of the key things that need to be addressed by the overall test plan associated with your development effort:

1. Acceptance Criteria - when the team thinks it is done, what will be used to judge whether the software can move in to the production environment?
2. Integration Test Strategy - what are the application touch points that need to be addressed?  This includes system to system touch points - messaging, it includes intra-application - application sub-systems - that need to be tested, if your replicating data - it should include testing the replication mechanism, and it should also include testing of the security mechanisms used within the application.
3. Regression Test Strategy - is it necessary to perform a full regression test against the application, or is it valid to consider a limited regression test based on the functionality being touched by the development team?
4. Test Data - what data can be used to ensure that you can execute all of the tests needed to validate the functionality of the system?  This should include both positive and negative testing of the application.
5. Recovery Test Strategy - depending on the system you are building, you may have include functionality to allow the system to recover from various types of failure points - if so, you need to ensure that you test the recovery functionality?
6. Security Test Strategy - depending on your application, you may or may not need to include elements to secure the data being captured and/or manipulated by the system.  If this is the case, you need to ensure that you are testing the security elements to ensure that you are not allowing access to sensitive and secure data to individuals that do not have the proper authority.

On top of all that, each individual developer should be responsible for developing and executing unit tests against the code that they are developing.

All in all, there is a quite a bit of activity that surrounds the overall test strategy associated with the development process.  You may not formally address each of the individual items identified above, but in some way, these will get addressed throughout your project.  Either by accident or by design, someone should be answering the above questions before you put your code in to production.

As the Project Manager, it is to your benefit to ensure that these questions are being asked early.  This allows for the entire team to proactively address the test strategy and test requirements.  What good is it for development to be finalized if the development team doesn't understand how they will perform integration testing, or if the team doesn't understand how they will validate the acceptance criteria?

Next time, I'll dig in to some of the tactics that I've used - both within the current Teams that I work with and within previous organizations where I've worked.

In the meantime, feel free to chip in to the conversation and talk to me about the strategies that you use within your teams to manage your test strategies.  What are the components you feel are important and who within your teams has responsibility?  I'm not hear to judge what anyone does, but by sharing, we all might learn something new.

Tags: SDLC, Software Development Lifecycle,  Project Lifecycle, Project, Manager, Development, Security, Secure Development Lifecycle, Communication, Testing, QA

For more information on David L. Collison: LinkedIn Profile

All it takes is a little communication

Back in action again with another posting.  My activity on this blog slowed down over the summer months as I focused on work and relaxing - probably a little more on the relaxing side.  Now it's time to  get back in the groove and start sharing again.  For those of you that have been reading this blog for a while, I hope you enjoy the new contributions!  And for those of you seeing this for the first time welcome - I'm attempting to share my thoughts and opinions on the software development process and the roles that people play.  My hope is that everyone reading through these articles can take away something that helps them, and that through the messages that I receive, that I learn something along the way.

In many of my past entries I've discussed various issues that can cause a project to go off the rails.  This could be anything from a minor irritation within the overall lifecycle, or it could be more significant causing a reevaluation of the overall project.  Obviously, I'd much rather deal with the former vs the latter, but as with anything in real life, we don't always get to choose the trials that we face.  And, sometimes we learn the most as we fight through the fire.

One of the things that I'd like to tackle in this particular discussion is the need for true open and honest communications between all members of the team.  Many times, an issue that surfaces within the overall project is the culmination of the effect of someone not getting out of their seat and talking with a team member.  Ok, getting out of your seat may not be the right terminology in today's connected and distributed world.  Team members have many options to connect with other team members - email, instant messaging, video conferencing, texting and - wait for it - good old fashioned face to face discussions.

Let's be honest with each other - how many times have we all been irritated and wanted to pull our hair out because the response we get from someone when it hit the fan was, "Well, that's what I was told to do.", or "That's what the design said to do."  In most instances I then ask the team member, "But you knew that wouldn't work, right?"  And in most instances I'll hear them admit that they knew the design was wrong or that the item in question had been overlooked or that they didn't feel that they could discuss it with someone else on the team.

To be clear, this is an example and the point of this post is not to lay blame for all issues at the feet of the requirements or design teams.  In many instances, the people doing the requirements and/or design work don't necessarily understand all of the fine details of how the system is plugged together. Understanding the fine technical underpinnings of the system is the responsibility of the technical teams.

If someone, anyone, on the project team identifies that something is missing, incomplete or just not right, it is their responsibility to get it corrected.  By whatever means are necessary.  It is not proper to sit on the issue and knowingly let your teammates head down a false path, or to let the project stall.  If you're truly on the team, you're invested in making the team, the project and the company successful in creating solutions that can be used by your customers. The key phrase, "you're invested"!  If you're invested in the idea, then that means you're taking it personally to make sure that it's right and that the end result exceeds expectations.

How difficult is it to poke your head up from what it is your doing to have a conversation?  Not every issue requires a meeting with 10 people in the room looking for various options and contingencies.  Take a stab at solving the issue on your own with a few key people.  Review your thoughts with key individuals on your team and then make it happen - get it corrected and resolve the issue before it has time to fester and become a potential roadblock to the project.  If you can't get to the bottom of it and find a reasonable solution, then work with the Project Manager to get a larger team of individuals to together to work through the issue.  Oh, and by the way, make sure you're keeping the Project Manager in the loop on what you've found - that doesn't mean they need to take control of the situation, it just means you're keeping them informed.  In fact you can tell them upfront: I don't need you to get involved.  I'm working through some options right now with a couple of people, if we can't find a solution by the end of the day, then I'll need you to step in and assist with coordinating a larger part of the team to help find a solution.

As I've said in past postings, people are messy.  We all make mistakes from time to time.  Maybe when putting the design document together I forget that a certain data element needs to be replicated to another application in the enterprise.  By forgetting to include this in the overall design, I have inadvertently introduced a situation that may impact the companies ability to bill for certain services or maybe the information won't show properly to the customer service representative answering customer calls.  In either case, the mistake was small, but the impact to the customer is real and measurable.  

If down the line, one of the software engineers notices that I overlooked documenting how the data element needs to be replicated between systems - it isn't the end of the world.  A quick call to confirm that "not replicating" the data wasn't an intentional decision and in fact was a mistake - allows the project to proceed.  Documents can quickly be updated and the change communicated to the rest of the team.  However, if the software engineer sees the mistake, doesn't say a word and we get all the way in to production without replicating the data, we have negatively impacted our customer by potentially billing improperly for services or by delaying assistance when they call in for help.

Look, one of the reasons we are all in the jobs that we are in, is to solve problems.  Sometimes that means sitting at your desk and doing what's in the job description.  However, in today's world, the job description is just the start of what you really do in your job.  You've also been hired to be part of a team!  It means removing the small roadblocks before they become big roadblocks.  It means uncovering and resolving those inconsistencies before they can be seen by the customer.  It means finding ways to work with others to provide the unexpected.  It means noticing that your teammate is stuck and helping find a way around the obstacle.  It means thinking through something that you believe is wrong - validating the assumption, and then working with the team to provide a solution before the issue has a chance to delay the project, increase costs or call in to question the need to finish the project.

Today, we are hyper-connected.  Take advantage of the tools that you have to break down barriers and talk with those around you to solve problems.  I don't want you to think that your job is to just satisfy the "requirements" or "design documents".  I want you to challenge those things that you think are wrong or that negatively impact the customer and work with others on the team to identify solutions that allow the project to move forward and meet or beat the timeline, reduce the overall effort and provide a superior solution.

Tags: SDLC, Software Development Lifecycle,  Project Lifecycle, Project, Manager, Development, Paradigm, Security, Secure Development Lifecycle, Communication

For more information on David L. Collison: LinkedIn Profile
 

Back to Security - Ignore and You'll Pay

Def Con 21 kicks off this week, so I thought it would be an appropriate time to swing our discussions back to the topic of security.  In some instances, repetition of a theme can become stale. Security is one topic where you must always pay attention and never, ever drop your guard.

Leading up to Def Con 21, white hat researchers have announced that they have figured out how to hack into both the Ford and Toyota automotive systems.  They have announced that they will release a 100 page report detailing their efforts.  While they will not release the specifics of how they achieved the takeover, now that they've reported it can be done, you can bet that others will follow suit.  According to reports, the researchers were able to force a Prius into suddenly slamming on the brakes while the car was moving 80 mph, they were also able to force the steering wheel to jerk and force the engine to race unexpectedly.  On the Ford Escape system, they were able to disengage the breaks on the vehicle while it was moving at low speeds.

Additionally, academic researchers have also figured out how the anti-theft systems of several automotive makers can be bypassed.  Volkswagen, Porsches, Audis, Bentleys, and Lamborghinis are all subject to the hack.  The researchers claim that they have figured out multiple ways to bypass the immobilizer mechanism by reverse engineering the algorithm.  Volkswagen actually preemptively went to the courts and received an injunction preventing the authors from publishing the details of their research.  While the judge has prevented the information from being published, now that it is known that it is possible to hack the algorithm, others will undoubtedly follow and perform their own research.

Earlier this year, a tool called "DropSmack" was created by a security consultant that used DropBox to remotely take over a PC.  The consultant was able to add macros to a Word document on DropBox and then use spearfishing techniques to get an executive at a company that he was working for to open the said document.  Once the document was open, the consultant was then able to take over the PC.

How many of you work in organizations that either knowingly or unknowingly have PC's that are connected to DropBox?

As altruistic as we would like to be, we live in a society where some people are intent on gaining access to systems that they don't own for various reasons.  Sometimes they just want the thrill of being able to gain access to something that they shouldn't have access to; sometimes they want to take everything you've got.  If you're not paying attention and doing the right things to secure your network, secure the applications you use and secure the applications you create internally, you're making it easy for the bad guys.  The latest report from Verizon - the 2012 Verizon Data Breach Investigations Report - identifies that 78% of all attacks last year, were targets of opportunity.

As you are designing software, the primary question you need to ask yourself is, how will someone attempt to use this to do something that they shouldn't be doing?

Security needs to be a significant focus of the design, build and test phases of the lifecycle.  Additionally, regular testing needs to occur once your applications move in to the production environment to ensure that the system is not vulnerable to the latest vulnerabilities.

I've heard some organizations make the claim that they can't afford to take the time to worry about this, that they are small and nobody is going to notice their web site.  Well, I hate to be the one to burst your bubble, but if your network is accessible via the internet - and who's isn't these days - then you're at risk.  If you don't take the time and dollars necessary to secure your web site and put the technology in place to protect your network, someone is going to find you.  They may not necessarily be looking for you, but they will find you.  They have built tools that move through the internet going from one system to the next looking for vulnerabilities.

If you haven't patched the software you've purchased to run your systems, and kept those patches up to date - then they will find it.  If you haven't patched the open source software you are using, and kept those patches up to date - they will find the opening.  If you haven't prevented cross-site scripting from impacting your web site, if you haven't prevented SQL injection - then they will find it.  There are easy things you can do to protect yourself and not all of it costs money:

1. Keep your systems patched to the most recent releases - whether purchased or open source.
2. Install firewalls in your network and keep the firewall patched to prevent unauthorized programs from accessing your network.
3. Institute and enforce policies for users to change their passwords regularly and to use strong passwords.
4. Install and use anti-virus/anti-malware/anti-spyware protection.
5. Don't open emails from people you don't know?
6. Institute whitelisting of applications and internet sites that can be used and accessed from within your organization.

From a development standpoint - if you're not familiar with OWASP, then you need to hit their web site and immediately begin to pay attention to the vulnerabilities that they report.  This site identifies the most common vulnerabilities impacting web sites.  They explain the vulnerability and recommend what you can do to prevent these types of attacks on your network.  I'm not saying that this is the be all and end all of security, but this site at least points you in the right direction.

You also need to ensure that your developers take the time necessary to educate themselves on secure development techniques.  This isn't an overnight miracle that will suddenly make you invulnerable, it is a process that will take time, but will slowly and surely improve the security stance of your applications.  They are books, websites and seminars dedicated to this topic.  Pick the one you can afford and get moving - today!

Tags: SDLC, Software Development Lifecycle,  Project Lifecycle, Project, Manager, Development, Paradigm, Security, Secure Development Lifecycle

For more information on David L. Collison: LinkedIn Profile

Security: Wrap Up

Just in case you haven’t been reading my past couple of posts – I’ve been discussing security.  Specifically, the need for organizations to take proper steps up-front within their development lifecycles to mitigate the risks of being hacked.

If you still don’t think this is something to be worried about, let me give you some information:

• A Forbes article in 2011 states that the average cost of a private information leak was $6.3 million: Forbes: Data Breach
• When crackers took down Sony in 2011, they reported that it cost them $170M to clean up the mess and put their sites back on-line: The Bright Side of Being Hacked
• As Verizon indicates in their report, many of the organizations hit did not experience direct losses.  They did end up spending money on forensics and recovery losses – how much can your company afford to pay an external forensics team to determine if you’ve lost data or not? Verizon: Data Breach Report

Unfortunately, cracking is not as difficult as you might think.  Here is a link that shows how crackers expose passwords once they’ve stolen the files off your system:

• AirsTechnica: How I Became a Password Cracker

If you really want to scare yourself – go to YouTube or Google and search on ‘How easy is it to hack someones computer’.  

This is the easy stuff – there are dedicated web sites used by professionals where they pass around password lists, sell and purchase stolen data, or give each other access to networks that they’ve cracked.  With a few clicks they can purchase or give away thousands of “identities” – ie: the customer data that they steal from you.  Are you keeping customer’s names, addresses, phone numbers, email addresses?  This is all stuff that the hackers want to get their hands on.  Even more so if your storing credit card information in your systems.  Do you keep bank account information and routing numbers so that you can process electronic checks?  Again, this is something the crackers will be after.

You may believe that your small potatoes and that the bad guys only concentrate on larger companies.  Nothing could be further from the truth.  They are scanning the internet and looking for weaknesses – they don’t care how big or small you are.  If you have a vulnerable system – they want to find it, they want to exploit it and they want to take as much as they can.  You need to build security in from the outset, you need to continually apply the latest security patches to your infrastructure and you need to ensure that your development teams – internal as well as external – are using industry best practices to mitigate security risks.

So, if my previous articles didn’t make you think seriously about incorporating security best practices within your organizations and the systems you develop, hopefully this article has helped tip the scales.  You need to review all of your systems, those built in-house and those purchased off the shelf or custom developed for your organization and you need to ensure that they provide the necessary security protections.

Tags: #sdlc, #softwaredevelopment, #lifecycle, #process, #applicationdevelopment, #security, #webdevelopment, #applicationsecurity

If you'd like more information on my background: LinkedIn Profile

Secure Development – How Protected Are You …

First up - after my last posting, someone that works in the security field contacted me to let me know that I should be referring to folks that try to exploit weakness within systems and to break in to systems are known as crackers.  I stand corrected.
 
Last time we chatted, I discussed the need for security.  Today, I’d like to expand on that topic and talk about the need for secure development.  The need for development teams, and the software development lifecycle, to account for security is more critical today than it has ever been.  In fact, as more and more of our devices live in an always on/always connected state – the risk to you and your data will only increase.   Many organizations spend time and dollars to buy physical hardware to sit on the edge of their networks to protect their data centers - but then forget to build security in to the software that they implement in to their production environments.

How many of you over the last several years have opened up your firewalls to allow staff members access to your systems from their laptops, their mobile phones and their tablet computers?  Using internally developed applications companies are exposing their systems and data to be used from anywhere, anytime.  While this increases the productivity of your teams, it dramatically alters your security stance and increases the likelihood that the bad guys will find a way in to your organization.

As stated in the last posting – Microsoft used to be the poster child for products riddled with security holes that crackers played with like Swiss cheese.  There didn’t seem to be a day that passed where I was not hearing of some new exploit against the MS-Office products, Microsoft’s server products or Internet Explorer.  It finally became embarrassing enough to the company that in early 2002, Bill Gates sent an email to every employee of the company to layout the strategy of developing applications that were hardened against the hackers.

This event was not only a pivot point for Microsoft, who now has a pretty good reputation in the industry for developing hardened applications, but for the industry as a whole.  It became common for companies to talk about the processes they were using to develop secure applications.  In fact, development lifecycles were modified to incorporate security concerns/risks in at the beginning of the process and to track them just like any other requirement for the software.

If you have development teams on staff or on contract, on-shore, off-shore or near-shore, you need to ensure that you are building security in up-front in the process.  That means training your development teams on the concepts of secure development processes, design reviews that review all of the business and security requirements, threat modeling, static and dynamic analysis of the generated code, penetration testing and ensuring that your test cycle takes in to account security.

Here, I will harp on the need for development teams to build unit and integration tests up-front in the cycle that will not only hammer the system from a functionality standpoint, but will also attempt to break the software and test the ability of the application to secure data and ensure that they are not opening back doors for intruders to use to gain access to the systems.  These tests need to be constructed in a manner that they can be added to the larger pool of regression tests and live with the code through its lifetime within production.

Can you look across your code base and answer the following questions:

1. Is my entire code base subjected to nightly or weekly builds with automated unit, integration and regression testing in place?
2. How often am I reviewing the test cases to ensure that they are up to date and address security risks?
3. What tools do I have in place that allows me to know that my entire code base is being tested – code coverage?
4. Do the tools that I use allow me to identify and report on the most common security risks?
5. Do the tools that I use provide real-time or near real-time feedback to the development team identifying where issues were found and what remediation steps are needed.
6. If I have the tools in place – are they actually being used and is someone held accountable to follow up on errors/issues that are found by the tools?
7. If I have the tools in place are metrics exposed to the management team?

No one solution works for every company and every development team.  I’m not going to sit here and point out specific products that you can or should use – that’s for you and your teams to work through.  What I am saying is that if you haven’t started this conversation, you are late to the game and you are potentially exposing your organization to huge risks.

While it is all good to discuss the tool sets, you also need to work on the mindset of the organization.  From the CEO on down, management needs to understand the risks that exist and the costs associated with the change in process that will secure your applications.  Additionally, they can’t be sold a bill of goods – do not make promises that you will magically eliminate all risks.  What you are doing is raising the bar and making it more difficult for the cracker to get in to your organization.  Again, going back to the last post – 79% of all attacks on an organization were targets of opportunity.  Meaning, the companies in play did not pay attention to industry best practices and literally left the doors open for the crackers to walk thru.

I’ve seen companies successfully deploy off the shelf solutions, open source solutions and a mix of the two to meet the security challenges of software development.  Your challenge is to find the mix of solutions that will allow you to meet the needs of your software development lifecycle and the threats and risks of the systems you develop.

What actions can you take to improve the security stance of your software development lifecycle?

If you'd like more information on my background: LinkedIn Profile