Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm researching models on building security into the SDLC and so far have come across:

  1. BSIMM
  2. Microsoft SDL
  3. Open SAMM

Are there any other documents and resources to look into? Specific tools that incorporate the principals of these models to help dev teams build secure software?

Also any resources that might be specifically targeted to Smartphone App Development would be great.

share|improve this question
up vote 5 down vote accepted

Microsoft SDL v5 is pretty decent and you have to full paper explaining the whole process that can be downloaded from MSKB:

If you need to get just a general grasp of the process, you can read a short and solid intro @ TechSurface:

There are several more esoteric ones, if you are interested:

  1. Maturity Framework for Assuring Resiliency Under Stress
  2. Correctness by Construction

For Android secured development, try those:

  1. - development focused.
  2. - for system security considerations.
share|improve this answer
I found this one today: – Epoch Win Feb 2 '12 at 19:17

Since you refer to SDL I assume you know it already, but to have it mentioned here: Microsoft provides a SDL Threat Modelling Tool (

OWASP hosts a primer about Threat Risk Modelling (and recommends the use of Microsoft SDL)

And of course NIST has a whole load of docs on this topic, e.g.: and:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.