Putting Theory into Practice: The Results of a Practical Implementation of the Secure Development Life Cycle

Abstract – Software engineering is defined as a discipline concerned with all aspects of software production from inception to the evolution of a system. It has often been referred to as the “cradle-to-grave ” approach to producing reliable, cost-efficient software delivered in a timely manner that satisfies the customer’s needs. However, with the introduction of the Internet and the World Wide Web, software engineering has been required to make changes in the way that new software products are developed and protected. In order to protect systems from hackers and saboteurs in a global society where e-commerce, e-business, and e-sharing are the “norm”, professionals should have sound knowledge in methods to protect data. Consequently, the area of information assurance (IA) has become one of great significance and it is important that the next generation of technologists are trained in development techniques that can ensure the confidentially and integrity of information. Traditionally, courses in secure software development are offered at the graduate level or in a stand-alone software security course at the undergraduate level. The aim of this paper is to present a framework for introducing software security to undergraduate students in a traditionally taught software engineering course. The paper focuses on and presents the results of a practical implementation of software security concepts learned through a service-learning project. The results from the study suggest that software security can be effectively introduced in a traditionally taught software engineering course through the implementation of a hands-on learning experience. Keywords – agile methods; secure software development service-learning; software development; software engineering; software security; traditional software development methodologie