Security Innovation SDL Implementation Case Study: Sony Corporation

Sony created a "near shore" development center that was tasked with low-cost software application development. Though the group was talented and efficient, the company faced several security challenges, including limited expertise on application security topics, high-visibility applications that were increasingly under attack and scrutiny, and the risk of retro-fitting existing applications to operate in increasingly "open" environments, i.e., the Internet, with no foreknowledge of operating environments or user intent, which means drastically accelerated risk. SI provided Sony a Microsoft SDL process assessment, gap analysis, roadmap creation, and training to help Sony determine their current state and move them from the Basic level of the SDL to a Standardized level.

Ideally, Sony would like to move to Microsoft SDL Dynamic level. In our initial engagement with them, they have already begun to adopt elements of the Advanced level and show potential to move through Advanced and into Dynamic within the next year.

Questions:

1. Considering the rise in vulnerabilities, how do you monitor the IT security project quality.
2. Analyze the effect of maintaining high quality on the overall schedule and budget of the project, as Sony progresses from the Basic level to the Standardized level, then the Advanced level, and finally the Dynamic level.
3. Explain the role played by stakeholders and the end user in maintaining quality of the project.