| Purpose: A large majority of software projects do not incorporate security from the word go. Alchemist intends to help solve this conundrum, by enabling a software development team in realization of highly secure and defensible application with built-in defenses/controls against security‐related design, coding and implementation flaws.
Alchemist is focused to present this solution by way of architecting a real-life high stakes software application in J2EE on top of Spring framework with security built into it right from the inception, step-by-step as it falls under an SDLC. It is important to note that Alchemist is not limited to J2EE or more specifically Spring framework. The idea is to demonstrate the upper spectrum of security practices that are often neglected or are done in bits and pieces by picking a well known widely adopted framework. Spring framework was chosen due to its widespread adoption in the financial products. Since the emphasis is on security architecture and defensibility, the future road-map is to demonstrate the same for applications built on other programming languages and frameworks.
Although this project is more than useful for existing/already developed applications, Alchemist is not the ideal solution to retrofit security into existing applications. It is aimed at offering more to applications that are at least in development, most in design phase. Allowing for language-specific differences, Alchemist builds this application with a strong foundation of security architecture that covers following main practices:
- Security Requirements
- Threat Risk Modeling
- Use and Abuse Cases
- Secure Coding Guideline