We will discuss the security assurance program by introducing some industry practices such as SDL, OWASP SAMM, and ISO 27001. SDL lists security activities through the whole development lifecycle. OWASP SAMM explains three levels of maturity to apply security practices in four different functional roles. ISO 27001 is considered the foundation of security certification standards and gives an overview of what a security management program should be.
Security assurance program
SDL (Security Development Lifecycle)
Microsoft defines the SDL (Security Development Lifecycle) to help developers to build secure software. The security activities in each development phase are shown in the following table:
|
MS SDL Stages |
Security... |
