While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What are the resources and tools that I should look into to make implementation of a Secure Software Development process or even Threat Modeling exerise, measurable? The existing resources focus heavily on network security so something specific to application security practices such as the list below is what I'm looking for:
- Threat Modeling
- Code Review
- Penetration Testing
- Secure Development
- Implementing Counter-Measures
- Counter-Measures costs vs Breach Costs