Desarrollo de software seguro basado en principios de seguridad por diseño (security by design) aplicados en una fábrica de software en guayaquil

Abstract

CONDITION FOR PUBLICATION OF PROJECT. This article proposes a software development methodological framework based on Security and Design principles. Its goal is to ensure that secure practices are effectively integrated into every phase of a software program's lifecycle. The argument here is that by integrating security early and structuring it in an orderly manner, we can prevent our systems from becoming vulnerable to serious errors. This will save money because the errors that cause so much work today are simply postponed until tomorrow or the following year, when funding is finally available. It is often argued that, through this approach, a system's resilience to everyday threats is better established. The research is justified by the growing need to strengthen security in applications developed in professional environments, especially in software factories. A qualitative-applied approach was used for the development of the project, based on the OWASP SAMM model, ISO/IEC 27001 guidelines, and tools such as OWASP ZAP and So-narQube. A technical pilot was designed and executed in a controlled environment, where best practices integrated into the design, coding, and testing phases were evaluated. The results showed a substantial improvement in the identification and mitigation of vulnerabilities from early stages. It is concluded that applying Security by Design principles in a structured manner favors more secure, sustainable software development that is aligned with current regulations. Keywords: secure development, life cycle, OWASP SAMM, vulnerabilities, technical standards. .