This question is indeed targeting SDL but for Scrum. The A-SDL from Microsoft is nice, but honestly I am not even daring testing it in reality as it seems too academic. I mean what they request for, requires an army of developers! or a dedicated Scrum for Threat Modelling --in case the models are sound! So, I would be thankful if you can share feedback on any SDL approach you have used for Scrum (including A-SDL as you may prove me wrong!)
Very good question... SDL and Agile are often seen to be at loggerheads, though they dont need to be.
I agree about MS's SDL, while I think its one of the best models for large companies, it is "heavy" (as I said in another lightweight SDL question), and has quite a lot of overhead. (though I dont think its academic, it just doesnt apply to most of us).
Without setting up a complete SDL here, and without context of knowing your org, I would say these are some of the important elements:
This is just the general outline... Let me know if you want more detail. Of course, what goes into each wedge, and what activities must be performed when/how, really depends on knowing your organization, culture, needs, risk profile, etc etc.
I find the overriding change in concept from "Classic" SDL (or "Waterfall" SDL) that needs to be accepted is:
Replace Scrum with ICONIX. The only thing that works with Scrum is security-focused iteration review and ratcheting. A lot of Scrum deployments are green-blue, so it would make sense to optimize these for security as well. It would be very smart to harden the VM if managed code is used, or to watchguard a banned function list. Additionally, secure external components could be used. There's actually a lot you can do, but forget about the SDL, Touchpoints, or CLASP.