Service Overview
The Secure Software Development Lifecycle (Secure-SDLC) Gap Analysis evaluates an organization’s current software development and DevOps practices to identify security gaps and recommend improvement steps. The main objectives are to assess the existing security posture within the development lifecycle, pinpoint critical weaknesses, and propose initial remediation actions to reduce overall system risk.
Methodology
The analysis is based on structured interviews with key stakeholders across the product development lifecycle. At the end of the activity, CYE communicates with designated client-side personnel to discuss potential follow-up assessments or deep-dive Secure-SDLC activities.
Deliverables
Secure-SDLC Gap Analysis Report:
Executive Summary: A high-level overview of the assessment and outcomes
Methodology
Detailed Description of Identified Security Gaps: An in-depth account of the security gaps discovered during the analysis
Follow-up Recommended Activities and Mitigation Plan: Suggested actions to address the identified gaps
Secure-SDLC Policy Document:
A formal policy document outlining the practices and guidelines to ensure a secure software development lifecycle
The policy incorporates and addresses all security gaps identified in the Secure-SDLC Gap Analysis
Prerequisites
Existing Secure-SDLC procedures and supporting documentation (if available)
Customer Engagement
The client is expected to provide:
2–3 hours of availability for interviews and follow-up via email or additional meetings, as needed
Relevant Standards
A proprietary methodology based partially on:
Microsoft Security Development Lifecycle (SDL)
OWASP Software Assurance Maturity Model (SAMM)
Security Domains Covered
Cross-organization policies, procedures, and governance
Security operations, monitoring, and incident response
Network level security
Servers, network equipment, and endpoint security
Application-level security
Sensitive data and information management
Identity management and remote access