METHODOLOGICAL FRAMEWORK FOR ANALYSIS AND SYNTHESIS OF A SET OF SECURE SOFTWARE DEVELOPMENT CONTROLS
This article discusses the issues of standardizing commercial production of secure software products. It studies administrative and technical controls for minimizing the number of vulnerabilities during development and operational support of secure automated systems software. We classified standards and guidelines on secure software development. We analysed applicability of the available methodological approaches to secure software development during evaluation of conformance to the information security requirements, including during certification of the software products. The article proves feasibility of harmonizing the developed regulatory requirements and practical measures with the methods stipulated in ISO 15408 and ISO 12207 international standards. We introduced the notion of secure software and developed a basic set of requirements that allows, among other things, evaluating the conformance of the software development processes to secure software requirements. We prove that the set of requirements shall rest, first of all, on the accepted security policies and up to date threats. Sample requirements under development are provided. We developed an original conceptual model for analysis and synthesis of a set of controls for secure software development that rests on a set of generated requirements. The article shows that the conceptual model gives the software developers an opportunity to make a science based choice of software development controls. We developed general methods for selecting a set of secure software development controls. We provide indirect proof of efficiency of the suggested approach. It should be noted that the suggested approach was used as a basis for the national standard on development and production of secure software.