Mitigating Software Vulnerabilities through Secure Software Development with a Policy-Driven Waterfall Model

Table 4

Limitations and their responses in PDWM.

Limitation	Response in PDWM
Serial execution	PDWM is developed much more on the lines of the waterfall method of SDLC with a serial execution. This ensures a stable development model useful for an experienced team
Rigidity	Since PDWM is developed sequentially, there is little room for error. However, the inclusion of security vulnerabilities and their solution in each phase reduces the risks. However, a risk management phase can further reduce the need for change once a phase is completed
Change handling	A change that occurs after a phase is completed can be handled as there are feedback loops in PDWM; however, the cost is higher than agile techniques. PDWM suffers from cost vs security tradeoff; while the security handling is enhanced, the cost of change handling cannot be reduced. This is also true for late discovery of requirements that could lead to newer security vulnerabilities
Flexibility	PDWM is not a flexible model like agile techniques. However, when considering security vulnerabilities, flexibility is a desired feature. PDWM addresses flexibility by employing experienced team and enlisting all security requirements for all stages of SDLC exhaustively
Delayed feedback	PDWM prioritizes security over all other requirements. It is envisaged that the user involvement should increase in each phase to reduce delayed feedback by the user
Exhaustive requirement gathering	Since the team is composed of experienced members, it is impossible to exhaustively gather all requirements during the requirements phase. However, change is still possible that can be handled using feedback loop at a higher cost
Large projects	While PDWM is not suitable for large projects, a component-based approach can be utilized in which multiple teams develop components using PDWM
Risk management	There is no risk management phase explicitly embedded in the model; however, risks of each security vulnerability are considered, and security requirements are generated for each phase