Core Software Security

3

Security Assessment (A1): SDL Activities and Best Practices

In this chapter, we will introduce the reader to the first phase of our security development lifecycle. This phase (A1) is called Security Assessment. We will describe different activities within this phase, why it is important, and then walk the reader through key success factors, deliverables, and metrics from this phase.

Security Assessment (A1) is the first phase of our SDL (see Figure 3.1). This is the phase where the project team identifies the product risk profile and the needed SDL activities; in some SDLs it is called the discovery phase. An initial project outline for security milestones and controls is developed and integrated into the development project schedule to allow ...