The Study of the Effectiveness of the Secure Software Development Life-Cycle Models in IT Project Management

Abstract

Software security is an important and a prevalent element in today’s society. The System Development Life-Cycle (SDLC) process that is currently used for most of software development does not address any security components until after the software is developed. The Secure Software Development Life-Cycle (SSDLC) is similar to the SDLC but includes security components into the phases. There have been many models proposed that are primary modified from preexisting SSDLC models. A study was conducted to survey different SSDLC models and their effectiveness. The authors first identified four popular SSDLC models in the IT industry, and then analyzed their common characteristics to derived four sets of Criteria for comparison. These criteria are: Focus Areas of Application, Implementation of model, Security Implementations and Enhancements, and Security training and Staff. The comparison results demonstrate that the Rastogi and Jones model is an effective one for being used for many IT projects. However, it is worthy to mentioned that one specific model cannot be used for all types of IT projects because IT projects are different.