Security development lifecycle

Portcullis security engineers work with organisations large or small as a core part of their security development lifecycle. Whether you are a global enterprise or small business looking for outsourced source code review or insourced security resource, we have services that can help.

It is widely accepted that the cheapest and most effective security controls are those that are conceived and implemented throughout the course of a project as opposed to tagged on at the end.

The concept of a secure development lifecycle is to consider the security requirements of a solution (most commonly, but not exclusively an application) at the outset and to monitor this throughout development to ensure that the final solution meets expectations. A development lifecycle does not replace the need for penetration testing or other assurance work to be completed at the end of the project; instead the expectation is that the issue count will be low with few (if any) ‘show stoppers’ that delay launch.

Our consultants are capable of introducing the concept, help design the initial requirements, perform the technical reviews and support the client through the entire process. It is not uncommon for this process to highlight other concerns, such as the capabilities of internal teams, undocumented standards and communicating such requirements through the supply chain. Portcullis has the experience and capabilities to address these tertiary issues as part of helping to develop and maintain a secure development lifecycle.

Why adopt a security development lifecycle?

• Build more secure software
• SDL and Compliance
• Reduce Development Costs
• Assess your security needs