1.0 Purpose
The purpose of the policy is to explain web application security using agile software methods for James Greene Web Services. This policy will explore methods which will integrate security into Agile Software Development methods. It will also include a policy that will be put in place to safe guard the code, data and access, while clearly identifying the CIA (confidentiality, integrity and accessibility).
2.0 Scope
This policy will include the web application security methods for James Greene Web Services and our affiliates for continuing our security measures while integrating Agile Software Methodologies. Security methods must be able to adjust the agile software development methods. They should not obstruct to the development
…show more content…
Making these plans is an actual way of potential methods when you know what the ending will be. If you are not sure, you must agree it takes multiple times get the results. With Agile methodology agrees there will be change and will accept.
3.1 The CIA triangle
The Confidentiality, Integrity and Availability (CIA) of information security was developed to provide a starting point for evaluating and executing information security regardless of James Green Web Services core systems. There are three areas of this triangle and they include: o Confidentiality - Ensures information system is accessed by only an authorized person. o Integrity – This ensures that the data or information system can be trusted. Having encryptions ensures information is protected. o Availability - Data and information systems are available when required. This ensures the network will be availability.
This triangle is considered the ground level of the information systems. To ensure the security of a well-built system, Information Security Governance along with management and policy must be maintained. There could be
…show more content…
o Lack of Security Awareness – As development persists, issues regarding security will need to be discussed and if there isn’t enough knowledge this could possibly become an issue.
There are possible techniques which can provide solutions for securing this method such Scrum Methodologies, Dynamic System Develop Method (DSDM) to name a few.
4.1 What is Scrum Agile Methodologies?
Scrum Agile Methodologies is the most popular of the methodologies. It is an outline that uses fixed sprints. Once a sprints has ended, a scrum team works together with a new one which starts until the projected is finished. The team consists of:
• Product Owner - The individual accountable for the outcomes of the development.
• Scrum Master - The individual accountable for the success of the team along with working with participants who are not on the team.
• The Development Team – A group who has various knowledge and experience with developing the system. o Scrum Practices:
Grooming
Sprint Planning
The Actual Sprint
Stand
Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.
Other security elements are in reference to data recovery, database administration, handling a breach in security and administrative security policies such as access procedure, employee transfer and excessive user access. As I assume the role of the chief security officer, database designer, database administrator, and chief applications designer this project is very important to the armed services and the Virgin Islands National Guard as we strive to provide global security.
Miller Inc. which is in the business of providing data collection and analytics services relies majorly on network security to keep its competitive advantage. This is because the customers that rely on the company's system trust that since there are sufficient security measures that have been ensured, they can store their data securely. Each of the functional models of the system should have sufficient security measures to ensure that complete security of the whole system architecture is achieved. The three functional modules are the backend module, services or operation module and customer access module. The major relationship between infrastructure and security comes in the role they play to ensure that the end user gets the data that they need when they need it and in the best way possible. Therefore for the three modules, there is a need to balance security with the right infrastructure.
The Department of Defense (DoD) is America 's oldest and largest government agency, with military traces dating way back to pre-Revolutionary times. The Department of Defense has since grown and evolved with the nation, hence becoming the national’s largest employer with over 1.4 million active duty soldiers, 1.1 million National Guard and Reserve forces, and 718,000 civilian personnel. With such a huge organization does come with a huge network, and security infrastructure network, and the burden to protect the information transferred or stored on that network. This means information is a strategic asset to the Department of Defense; it’s therefor the goal of this security policy to provide guidelines of implementing
Any hackers will attempt to violate this three element of security (CIA) Confidentiality, Integrity and Availability:
Any system of communication when it is designed these security services are taken into account and these security services must be defined,and can be shortened format as (CIA) [17].
The Scrum Master is in control of all Scrum processes. He supervises that the Scrum rules are adhered to and is responsible for the success of Scrum.
Agile techniques should be used to solve the current issues faced by the company as agile techniques normally being used by the software industry help the business to act in response under the unpredictable situations faced. In Agile methodologies opportunities are been provided to evaluate whether the project is under the direction all through its development cycle. All this is being accomplished with the help of regular tempo kept in work, and the teams must show a product which is having the desired potential.
Agile is an iterative and incremental (evolutionary) approach to software development which is performed in a highly collaborative manner by self-organizing teams within an effective governance framework, with "just enough" ceremony, that produces high quality solutions, in a cost effective and timely manner which meets the changing needs of its stakeholders [1].
Initially we should start with identifying and defining the four security components to ensure we have a clear understanding of what they are and how to implement them. The components of information security are Confidentiality, Integrity, and availability also known as the CIA triad. Confidentiality in Information Security is defined as the protection of information from disclosure to unauthorized parties (Chia, 2012). Integrity in Information Security is defined as protecting data from being modified by those not authorized to do so. Authentication is defined as proof that the individual requesting access is who they say they are. Non-repudiation is an assurance that someone cannot deny something, in information security this might be completed
In shaping a new security policies, it is essential to have a full understanding of all aspects of the internal network and services to be protected from both internal and outside threats. An article by Solms & Solms (2004) outlines several criteria in developing information security. First, a governing body must be formed to ensure all sensitive data is secured and provide due
This area of the Security Policy articulation presented is a report that all in all make up the Security Policy that administers the activities of the Campbell Computer Consulting and Technology Company. The security strategy covers the accompanying:
Agile is a member of software development mode. Actually It is not a technique. I think not only it is a methodology, but also it is a process of development software. It will show and guide us to finish the development step by step according to the project required. However this kind of development mode is driven by human. The human will control the direction of the project.
Confidentiality, integrity, and availability (CIA) are the main goals of programs designed to protect information. The first goal, confidentiality, is an assurance that information will be safe, secure, and private. The second goal, integrity, concerns itself with the validity of the data being protected. Lastly, availability means that resources can be accessed when needed for the protection of the data.
In this method, the team member is responsible for completing work and team determine how it can be completed smoothly(Scrum).