Assessing Information Security Risks in the Software Development Life Cycle

Information is among the most important assets in any organization. Organizations are constantly building more complex applications to help them accomplish their mission and are entrusting their sensitive information assets to those applications. But are their information assets secure as they are transmitted, modified, stored, and displayed by those applications? Are new applications developed in a manner that will keep those sensitive information assets secure? How can we know for certain? The answers to these questions are all related and involve the process of assessing risk. The concept of risk – the net negative impact of the exercise of a vulnerability, considering both the probability and the impact of occurrence [1] – is a concept that is hundreds of years old. Even the concepts of measuring and weighing business risks have been around for a long time. Insurance companies calculate risks every day and use the calculations to set rates for life, health, and property coverage