SecSDLC Methodologies: Analysis of Agile, Lean, and Waterfall Models

This report provides a comprehensive analysis of SecSDLC methodologies, focusing on Agile, Lean, and Waterfall models. It explores the core principles of each methodology, comparing their strengths and weaknesses in the context of software development and security integration. The report delves into how security blueprints play a crucial role in planning, maintenance, and change management across these methodologies. It also discusses the importance of risk management, encompassing risk identification, assessment, control, and mitigation. Furthermore, the report examines the development, maintenance, and enforcement of information security policies, standards, practices, and procedures. The discussion includes the integration of these elements with contingency, disaster recovery, and business continuity planning. The report concludes by addressing how SecSDLC is directed and managed within organizations, emphasizing the importance of a secure software development lifecycle to protect against threats and vulnerabilities. The report is a comparative analysis that offers insights into selecting the most appropriate SecSDLC methodology based on project requirements and organizational needs.

Running head: SECSDLC METHODOLOGIES
SECSDLC METHODOLOGIES
Name of student
Name of university
Author’s note:

1
SECSDLC METHODOLOGIES
Table of Contents
Introduction....................................................................................................................2
Discussion......................................................................................................................2
Methodologies............................................................................................................2
Comparison of the models.........................................................................................4
Advantages of waterfall model..................................................................................5
Disadvantages of waterfall model..............................................................................5
Advantages of agile model.........................................................................................6
Disadvantages of agile model....................................................................................6
Advantages of lean model..........................................................................................7
Disadvantages of lean model.....................................................................................7
Role of security blueprint in planning, maintenance and change management.............8
SecSDLC directed and managed....................................................................................9
Conclusion....................................................................................................................11
References....................................................................................................................12

2
SECSDLC METHODOLOGIES
Introduction
The secure software development lifecycle could be described as the processes that
allow any organisation in completely integrating the security aspects in the prevailing SDLC
from the initial development with the help of obsolescence and the maintenance. SecSDLC
refers to the process that includes distinct phases requires to complete a project in a step-by-
step format. SecSDLC helps to acquire required number of resources in a secured way and at
the same time predicts risks that are encountered in a project (1). This comprises of six
distinct steps including investigation, analysis, logical design, physical design,
implementation and maintenance. It is the primary objective of SecSDLC to predict risks and
threats that are linked to a specific project. It helps the software development teams to reduce
the security related risks while creating software and different applications. There are mainly
three SecSDLC methodologies that are used in the present times.
This report intends to analyse the three SecSDLC methodologies and compare the
various features of the methodologies. The secure software development life cycle efficiently
follows the similar methodology as most commonly referred as the software development life
cycle, but they are different in some aspects which creates one method mainly preferred than
the other one in the software development.
Discussion
Methodologies
Agile: The agile planning could be described as the kind of planning for software
development that effectively estimates the work with the help of the self-contained units of
work that are referred as the iterations or the sprints. With the help of the agile model in the
software maintenance the developers could effectively estimate the issues that could be faced.
The bugs could be easily prioritised by the customers, the company could gain the common

3
SECSDLC METHODOLOGIES
database of bug tracking and failing unit tests could be created by the developers (2). With
the introduction of the agile methodology, the change management could be effectively
handled. The change managers could be engaged in the earlier stages of the project, constant
communication would be established and engagement of the senior leaders would be allowed.
The principles of agile software development consist of the following:
1) Satisfaction of the customers by delivery of software in a proactive and continuous
way. When customers receive services in terms of working software at proper
intervals of time.
2) The changes in requirement are accommodated and delays in delivery are avoided.
3) There is a collaboration built between the shareholders and developers.
4) The involved people are motivated and thus they deliver their best work.
5) Technical detailing and design helps in the enhancement of agility.
6) Development process is just enough for completion of the task.
Lean: Unlike any other software development methodology, there are no strict plans
for the lean projects. It is due to the fact that the elements might change effectively in process
of the project realisation. The lean teams mainly improves the plans consistently. In the
maintenance phase, the lean model mainly reduces requirement of multitasking by the
emphasis on working at one aspect at one time. This model mainly comes with major benefits
to any organisation where the agile iterations eradicate the long pre-planned specifications.
At the stage of planning of a project, the lean life cycle starts and this has lenient
methodologies (3). The elements change in the project realization process. After the
completion of project planning the iteration planning process starts and every iteration has its
specific plan. When the plan is deployed, team starts the process of testing which are very

4
SECSDLC METHODOLOGIES
important for Lean projects. Developers find it helpful in delivery of their products on time to
the customers. The ending phase of the cycles also refers to the waste elimination time. Work
is analyzed; unimportant actions are detected and not repeated in the next iterations
Waterfall: The waterfall methodology in the SecSDLC could be described as the
sequential model that helps in dividing the software development within the various phases
(4). Each of the phases has been designed to perform particular activity in the SecSDLC
phase. In the planning stage, the detailed requirements of software system are effectively
gathered from the client. The maintenance stage is significantly easy than any other
methodology. As soon as the system has been declared ready to utilise, there might be later
requirement of changing code according to the request of customers. In waterfall model every
phase must be completed before the next development phase. It suits the small projects in
which there are well defined requirements. Quality assurance checks are performed before
completion of each stage and document elaboration done at each development cycle phase.
The dependency of the project is completely on the project team with client interference at its
minimum. The software changes are always made during the development process (5). The
waterfall model finds its usage when there are no complicated applications, short project,
clear requirements, stable environment, stable tools and technology and trained resources.
Comparison of the models
The waterfall model is the traditional way to organize the software development
lifecycle and this owes its origination to the industrial areas that include building or
manufacturing. Gradually the waterfall model was incorporated in software engineering as
well as the IT-industry (6). The main principle of this model is following a strict sequence of
certain developmental phases that are performed with respect to a specific coherent plan.
Software creation requires adhering to the steps provided below:

5
SECSDLC METHODOLOGIES
1. Discussing the idea
2. Analysis of the requirements and planning
3. Design
4. Coding and implementation
5. Testing
6. Release of the product
7. Maintenance and support
This is a linear model that means one can go to the next step only if the previous step
is completed.
Advantages of waterfall model
1. It is easy to work with and helps in managing as well as controlling the various phases in
software development cycle.
2. The documentation needs to be done in a proper manner in waterfall model thus helps in
better understanding of logic of the code (7).
3. The outcome or the result to be obtained is known to the users or the clients from the
initiation of the program.
4. With this model meeting the deadlines is easy.
Disadvantages of waterfall model
1. In this model there is no space for error as once a stage is completed no changes can be
done.
2. The initial information provided at the initiation of the project is not always correct.

6
SECSDLC METHODOLOGIES
3. Lack of proper communication as one project is divided into distinct stages and different
teams are deployed to carry out the operations (8).
The waterfall model is made use of in simple projects specifically in those projects where the
clients have a proper knowledge of the outcome.
The agile model addresses the shortcomings of the waterfall model and the major
difference in between these two is flexibility. The agile model unlike to the waterfall model is
open to alterations and there is a space for continuous improvement. This model is both
incremental as well as iterative in nature (9). The scope of the project in this case is divided
into smaller modules or in general sprints. Each of these sprints last for a fixed time span
such as a week or so. The stages involved in agile model are:
1. Planning
2. Analysis of requirements
3. Design
4. Coding
5. Testing
6. Launching
All these stages are flexible in nature unlike in waterfall model and these phases are not
required to be carried in a chronological order (10).
Advantages of agile model
1. In the agile model changes are always welcome.
2. Enhances and encourages teamwork
3. Encourages participation of clients
4. Adheres to quality
Disadvantages of agile model
1. Lack of proper planning

7
SECSDLC METHODOLOGIES
2. Documentation is neglected
3. There can be a difference in between the desired result and the result obtained.
Thus the main difference in agile and waterfall is that the former is flexible while the latter is
not, former neglects documentation while the latter lays stress on it.
Lean software development optimizes development time as well as resources by
eliminating the wastes and delivering only that which the products need (11).
Advantages of lean model
1. This is a streamlined model and thus has scope for more functionality which is delivered in
less amount of time.
2. This model eliminates the unnecessary activities thus bringing in reduction costs.
3. Helps in making decisions boosting morale.
Disadvantages of lean model
1. This model heavily depends on teams that are involved and thus is not scalable as
compared to the other models.
2. Needs strong documentation and any mistake done in the same can result in the failure of
the project.
In all the above models discussed above, integration of security that is secure software
development life cycle will mean that various security assurance activities are conducted at
each of the stages. The security assurance activities are penetration testing, reviewing of
code, and analysis of the architecture (12). In this, security is a primary concern thus resulting
in the development of secure software. This helps in reducing costs as well as detecting the
flaws at an early stage.

8
SECSDLC METHODOLOGIES
Role of security blueprint in planning, maintenance and change
management
In a project planning, maintenance along with knowledge management plays an
important role. SDLC ensures that in each of these stages the project scope is adhered to and
the all tasks are completed in time. The security related activities are performed at each of the
stages of software development. In the planning stage, each developer has its own format to
come up with the design as well as distribution of a specific strategic plan. The primary
elements of planning are same in all cases and the only difference is aligning the security
aspects to the stages. SecSDLC will help in creating a strategic information security plan to
ensure that the software developed is secured from hackers. In maintenance part the
SecSDLC refers to the proper update to the software aligning to secure software development
life cycle (13). This in turn will help in preventing vulnerabilities enabling organizations to
meet requirements and protect their data. The SecSDLC maintains the application in the
production phase. Implementation of SecSDLC in the initial stages of application
development is considered more cost effective compared to remediating the same in the later
stages. In this, security is a primary concern thus resulting in the development of secure
software. This helps in reducing costs as well as detecting the flaws at an early stage.
SecSDLC thus keeps a check on the security issues that can certainly pop up in the project
development phase. Applications created or software development passes through different
stages and thus in order to save these from the attackers, security should be given priority.
SDLC supports change management as these follow a specific order of the tasks to be done
while developing a software. For instance in agile, the details of all sprints are known that
helps in management and organization of the project (14). All the stakeholders involved are
knowledgeable about the tasks and thus it promotes knowledge management. Knowledge
management is important in all spheres and in case of software development as well this

9
SECSDLC METHODOLOGIES
plays a vital role. It is said that management of knowledge along with experience are the key
means which can be made use of to systematically develop software and focus on
improvement (15). Knowledge management in case of software development is a vital factor
as in order to incorporate the changes in the system there is a need to align to knowledge
management.
SecSDLC directed and managed
The security software development life cycle follows same methodology as software
development life cycle differing in certain activities. The SecSDLC is directed and managed
by following six different phases that are as follows:
1. Investigation- In this phase SecSDLC starts with a directive from the upper
management that specifies process, goals, budget as well as outcomes of a project (16). This
also considers the other existing constraints that can be encountered while developing
software.
2. Analyst- The existing security policies need to be analyzed along with the potential
threats and associated risk (17). This is help to think of the counter measures that in turn can
help mitigate issues.
3. Logical Design- This is the phase in which the project teams develop the blue print
for security. In this stage, various factors related to the development of software is examined
so that the key policies can be implemented that help in taking decisions in the later stages.
4. Physical design- In this specific stage, the team members evaluate the technology
that is required to support the security blueprints generating alternative solutions agreeing on
a final design (18).

10
SECSDLC METHODOLOGIES
5. Implementation- The security solutions are first acquired, then tested, implemented
and again tested (19). In this stage the personal issues are properly evaluated and specific
training along with education programs is conducted.
6. Maintenance- Once the software is developed, it needs to be maintained and
properly managed so that this can be kept up to date by the means of some established
procedures (20).
Conclusion
Therefore, it could be concluded from the above discussion that the waterfall
methodology is most effective for the SecSDLC. The waterfall methodology in the SecSDLC
could be described as the sequential model that helps in dividing the software development
within the various phases. In the planning stage, the detailed requirements of software system
are effectively gathered from the client. The maintenance stage is significantly easy than any
other methodology. The planning stage involves analyzing the security requirements that
need to be in place for the development of the software. It has to consider not only the
production related aspects but has to include the security issues that a certain application can
face after getting released to the market. The reasons for failure of software due to security
issues needs to be analyzed and as per this work proceeded. The maintenance phase focuses
on the maintenance of the software after it is developed so that it does not fail at any stage.
The SecSDLC helps in aligning security to the SDLC thus given priority to security issues.
The security software development life cycle is an important emerging process that can align
security to the phases of development related to the software. Thus it can be said that
SecSDLC is a variation of SDLC that considers the security issues. SecSDLC helps in
discovering risks and the potential threats so that help in the project development cycle. Thus
it can be understood that in case of software development planning, maintenance as well as

11
SECSDLC METHODOLOGIES
knowledge management is required. Secure software development life cycle is thus a
necessity and should be incorporated in phases of the software development life cycle.