Security by design in government software

Government guidance is consistent on this point: security must be considered from the start of a project, not tested for at the end. The cross-government Secure by Design approach, mandatory for central government departments and arm's length bodies, treats security risks as business and delivery risks and makes security the responsibility of everyone on the project team.

Why late security fails

When security is left to a penetration test shortly before launch, the findings arrive at the point where changing the design is most expensive. Teams then accept risks they would not have chosen earlier. Most significant security decisions are architectural: how access is controlled, where data is held, how components communicate and how changes reach production. They are best made deliberately, early.

What designing it in involves

• identifying threats during discovery and alpha: what needs protecting, from whom, and what the impact of a compromise would be
• role-based access on the principle of least privilege, with every access to sensitive data recorded in an audit trail
• collecting and retaining only the data the service needs
• secure development practices: protected code repositories, peer review, automated checks on third-party components and a secured build and deployment pipeline
• testing security controls regularly throughout delivery, with independent testing before major releases
• a plan and budget to manage security for the whole life of the service, not only until launch

These points reflect the Service Standard, which asks teams to follow the Secure by Design principles, keep an assessment of security risks and "regularly test security controls", and the National Cyber Security Centre's principles for secure development and deployment.

What certification does and does not tell you

Cyber Essentials is, in the NCSC's words, "the minimum standard of cyber security recommended by the Government for organisations of all sizes". It covers five controls: firewalls, secure configuration, security update management, user access control and malware protection. Certification shows that a supplier's own organisation meets that baseline. It does not, on its own, assure the software the supplier builds for you. Buyers should look for both.

Questions to ask a supplier

• How and when do you identify threats to the service?
• How are access to code, environments and production data controlled and logged?
• How are third-party components chosen, and how are vulnerabilities in them tracked and fixed?
• How are security controls tested, and how often?
• What security documentation will we receive at handover?

brytloop holds Cyber Essentials certification and designs role-based access, audit trails and security testing into delivery from the start, rather than adding them at the end.