Handling of Security Requirements in Software Development Lifecycle
summary
A unified process and an open source tool called SecurityRAT maps ASVS to artifact properties and reduces 182 ASVS items to 107 requirements for a given artifact, then exports those requirements into Jira and creates batch dev tickets with YAML attachments for tracking. An automated slide generator and a testing service, SecurityCat, run microservices (ZAP, code checks) to return per-requirement confidence scores. The project is OWASP-listed, works in production, and plans v2 imports, tech-specific rule sets, tighter testing integration and more issue/CI/chat integrations.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:19The fast pace
- 0:57Security documentation
- 1:36Security in HR development
- 4:30Outsourcing development
- 5:46Solution
- 6:10Requirement Automation Tool
- 9:24Security Rat Overview
- 9:45Adding Parameters
- 10:59Looking in the Database
- 12:32Persistence
- 15:00Artifact
- 16:29Ticket Status
- 17:44Create Slides
- 18:01Browse Requirements
- 18:21Export Requirements
- 19:35Update Requirements
- 19:52Accept or Decline
- 21:02Security Cat
- 30:20Code Block
- 31:45Machine readable requirements
- 33:20What we are currently doing
- 34:48Alternative Instance
- 35:45SecurityCat
- 36:18Import Requirement Sets
related talks
55mBuilding a sustainable security requirements process with the ASVS
55mASVS Project
45mMaturing Your Application Security Program with ASVS-Driven Development
20mSecure Software Development Lifecycle
34mMastering Security Requirements Engineering
24mFlagship Projects: Application Security Verification Standard
34mAutomating Security Test Cases Based On ASVS
26mFlagship Projects: Security Knowledge Framework