I require a 5 page information assurance guidelines document. Please see the attachment.

ABC is a software development company. It is a medium enterprise that has a wide range of clients from all over the country. The company has its headquarters in Miami, Florida and branches in the United States. The company is making plans to expand out of the United States beginning with Mexico and Canada. ABC focuses on the development of customer made application software. This means that most of the software created in the firm is specifically requested by the clients. However, some generic software is also created which can later be purchased by a client and re-engineered to fit their specific needs. The software assurance guidelines used by the company are specific to the type of software made. Desktop applications have different assurance specifications from web applications. The guidelines specified will be implemented from development all the way to the client organization. The software guidelines can only be efficient when both the developers and the users adhere to them.

The company does provide a number of software applications for the government. These applications include Account Pro, which is accounting software. It is desktop software and it is very optimal. The company also provides the government with a police record system. This application is web based and it relies heavily on the internet and the local area networks of the police stations. The application is optimized by a database that stores all of the information.

The firm is organized into four different departments. The first department deals with installation and maintenance of software. This is the after sale services department. This department is vital in the company since software often require patchwork and maintenance. The second department is the specifications research department. This department work hand in hand with the clients to determine the software that the clients require most and they communicate these requirements to the development department that is made up of developers who code and test the applications. The marketing and sales department ensures that the company has good public relations and stays relevant among the clients.

The system design life cycle that is used in the organization is quite traditional and standard. The first phase is planning and information gathering. In this phase the system requirements are gathered and information is gathered from the users. In the next phase, this information is organized and the system is proposed that will be able to solve the problems. Next is the design phase where the coding is done to develop the system. After coding, the system is taken into testing and debugging. If it is optimal, it is taken into the implementation phase where it is introduced to the clients. Maintenance is the last phase that requires updates and patches which leads us back to the first stage and it becomes a cycle (Avison and Shah, 2007).

Software Assurance Techniques

The guidelines are applied in the phases by ensuring that the specifications gathered are exactly what the client wants. The system design and coding is optimized by debugging and testing and the people who will be in contact with the system are supposed to be trained in the implementation phase so that they are able to use the system optimally and avoid performing tasks that may be detrimental to the application.

ABC Company produces software that is consumed by the United States government. The company produces desktop, web and database applications. The software that the company produces will be analyzed in this section to determine the security and performance risks associated with all of these applications as well as the possible implications that these risks may have to the clients. For each risk, techniques for software assurance will be proposed and how these techniques can be applied to ensure that the application is optimized at all times.

ABC Company offers a wide range of desktop applications. However, the most robust of all these applications that have been sold to the government is the Account Pro application. This is software that is installed to a workstation computer and it enables the user to be able to perform complex accounting functions rather easily. However, the person manipulating it must have both accounting and information technology knowledge so that he or she can be able to manipulate the software well. The software does not do all the accounting independently and it requires the expertise of an accountant to be able to function best. This accountant must also be conversant with information technology knowledge in order to operate the application.

The application has all the characteristics of a desktop application. This means that it is at a lower risk of intrusion from the internet and other forms of attacks. However, it is still cumbersome to install and maintain. This is why maintenance and installation has to be done independently on every workstation. The ease of access is also reduced since the user has to move to the physical location of the computer with the application in order to access it (Lee et.al, 2008). This makes the use of desktop applications unfavorable due to the cumbersome nature.

However, the application is very robust and optimized as far as security is concerned. Guidelines such as the use of user authentication have been put in place to make sure that unauthorized users don't get access to the application. The main threat that the clients face while using this application is however, not from third party intrusion but rather from it becoming out-dated (Lee et.al, 2008). This can reduce the general productivity of the application making it harder for it to be used to solve most if not all of the accounting problems of the client. This will make it inefficient.

The application can become out-dated and after five to 10 years, it will no longer satisfy the organization needs that had been identified. Thus, to mitigate this threat, regular maintenance is done on the application and any new requirements are added to the application. This maintenance and patchwork is an aftersales service that the government is happy to pay for.

The web applications sold by the company are often optimized by a database thus making them two in one. The developers prefer php platform to develop these web based applications and the database server most used is SQL. The two platforms work well together once linked to create an optimal application. The company sold a web based application to the police department in south Miami that has been able to help them keep records of the statements made by the public and the arrests that have been made on these statements. This system has also helped them keep record of the development of these cases.

Such a system is easier to use than a desktop application since you can be able to access it from anywhere as long as you have internet connection and access the police local area network. It is also easier to install and maintain since the installation is done on a central server and all the users access it in a client-server architecture. This means that the users access it through a web browser (Meier et.al, 2013).

However, this application comes with a high risk of third party intrusion. This means that the application can be accessed by an unauthorized third party. Such access can cause the organization of the client to be vulnerable and their records to be tampered with. This can cause unprecedented losses. To handle this, the application does have user authentication and user accounts with logs to help monitor the activities of each user and identify unusual activity. However, the LAN in the police department also needs to be optimized with firewalls and honeypots (Meier et.al, 2013) to ensure that any third party that tries to access the network and thus the application through hacking or cracking is not able to do so.

Another threat that the clients may experience is the need for scaling. The records will increase in number and with time, the department will require a larger database with a larger capacity so as to be able to hold all the records available. This scaling is done through maintenance by slowly expanding the database as the requirements of the user increase. The functionality of the application is also updated regularly.

Software security involves combining several strategies to develop integrity, privacy, availability, usability and confidentiality. There are various non-traditional development models that can be used to achieve these objectives and various ways to reduce security threats using agile development models such as Scrum. ABC Corporation will use the scrum methodology. Scrum provides a firm with freedom to execute most operations. One of its most important aspects is the elimination of a regular manager. The following is the overview of the important concepts involved in the model (Avison and Shah, 2007).

The Scrum team has three roles. The first one is the Product Owner that represents the stakeholders and clients. The Scrum master, on the other hand, helps in eliminating problems, while the Developers have the skills to transport products within the system. Stories are the needs that are stated from the perspective of the clients. Product Backlog is a list of requirements, stories, and objects that need completion so that they can provide end- product. Tasks and subtasks represent steps created based on backlog items. In the sprint planning, the members of the team select objects that need to be finished in the subsequent sprint from backlog (Lee et.al, 2008). Sprint works as the platform in which tasks are completed. It is during the sprints where items are redefined, deleted or added.

The Daily Scrum is where team members meet and discuss the previous achievements and focus on the upcoming activities. The definition of done is a criterion to examine whether items are ready after a test is performed. The sprint review occurs at the final stage; the teams check for any issues that emerged after completion of every sprint (Avison and Shah, 2007). The sprint retrospective is where the members of the team look at the final product and do reviews. It is at this point where members can reflect on the activities and make suggestions for further developments.

This is a summary of the steps involved in the Scrum operation. First, product own develops a wish list known as a product backlog. Secondly, in the sprint planning, the team takes the top priorities from the wish list and describes the ways of implementing the pieces. Thirdly, the team takes some time like four weeks to ensure completion of the task. It is important to understand that the team will have daily meetings to ensure there is satisfactory progress. The Scrum master has the function of making sure the team focuses on the primary goal (Meier et.al, 2013). During the end of the sprint, the task will be completed and can be transported to the clients or presented to the stakeholders for assessment. In the end, there will be sprint review and a retrospective.

When dealing with Scrum there are various security threats. For instance, in each Sprint approach, there are issues with security flaws that might allow hackers to access the crucial information of the company. In this case, there is a need to employ experts to help in the management of the risks. Another mitigation strategy is the addition of extra testers to perform regular checkups on the system. Another risk that might occur is the lack of enough time to address potential security threats. An example of a risk is the emergence of viruses that might adversely affect critical information. In such a case the clients will be informed of the occurrence of the issue and look for a way to stop any further destruction by the virus. The firm will also have to input other resources to address the problem (Lee et.al, 2008). In summary, if a threat is critical, there will be a need to carry out an urgent action. The critical issue will have to be dealt with on a daily basis to ensure there are effective measures in place to stop the threat. The organization members will have to notify the senior management of the risk. On the other hand, when the issue is minimal, the review of the system would be carried out quarterly.

There are various security regulations provided to minimize risks. The first activity is the development of artifacts. They include security architecture, the definition of security threats, risk analysis, and the process of setting guidelines to reduce effects of the risks. ABC Company should have a group of security developers that will be in charge of maintaining security; this is crucial because duties will be delegated to the members of the team and a single individual will not perform many tasks (Meier et.al, 2013). First, there is a need to provide training on particular technologies like database engines, frameworks, and operating systems. Secondly in order to reduce threats is to provide a proper review of the interface, code and test case. Another policy that is critical to the reduction of security threats is to utilize security testing to ensure everything is secure. The other process is the establishment of safety audits at any particular time in the project. Finally, reviews are developed after completion of objects in the backlog and time checks are developed at control points.

 Complete the Security Static Analysis section:

· Prepare a design for an application your organization might produce.

· Include appropriate diagrams to identify the major components of the application.

· Describe the major components and potential security issues where appropriate and as related to the security development model.

· Create code samples in C, C++, or Java to illustrate the tenets of the security development model.

· Identify at least 3 security static-analysis tools, and prepare guidelines for how they would be used in the sample code and throughout the software development in the company

Meier, J. D., Mackman, A., Dunner, M., Vasireddy, S., Escamilla, R., & Murukan, A. (2013). Improving web application security: threats and countermeasures. Microsoft Corporation, 3.

Lee, D. C., Crowley, P. J., Baer, J. L., Anderson, T. E., & Bershad, B. N. (2008, April). Execution characteristics of desktop applications on Windows NT. In ACM SIGARCH Computer Architecture News (Vol. 26, No. 3, pp. 27-38). IEEE Computer Society.

Avison, D. E., & Shah, H. U. (2007). The information systems development life cycle: A first course in information systems. McGraw-Hill.