After we have done the development, secure code review, and security unit test, the firmware code is checked in. At this point, the validation team can perform the security validation and penetration activities. The real secure validation work starts much earlier, namely, during the threat modeling phase. At that time, the security validation team needs to be involved in the threat model discussion and prepare both the security validation plan and the penetration test plan.
Security Validation Plan
In Chapter 2
