The sdl tag has no wiki summary.
16
votes
1answer
210 views
Secure Development costs
I'm wondering if anyone has seen any case-studies or references from companies who have implemented a secure development process (eg, SDL or similar) around the cost/effort involved.
Obviously each ...
12
votes
3answers
392 views
Startup security
I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...
12
votes
2answers
708 views
The Creation of Secure Software Development Environments
[Edit] I did complete an analysis and framework of concepts
that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct ...
10
votes
6answers
304 views
Are all security requirements expected to be testable?
Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
7
votes
2answers
215 views
I am looking for feedback on Secure Development Lifecycle for Scrum that has been tested?
This question is indeed targeting SDL but for Scrum. The A-SDL from Microsoft is nice, but honestly I am not even daring testing it in reality as it seems too academic.
I mean what they request for, ...
6
votes
2answers
209 views
What is considered the simplest (or lightest) secure development lifecycle?
Microsoft has there simplified SDL:
"The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development."
"The process outlined in this paper ...
5
votes
2answers
325 views
Established Security Design Patterns?
In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
4
votes
1answer
398 views
Data loss protection in software artifacts
Data loss protection is a major concern to every industry. The software engineering process involves multiple points for potential data loss, as a number of parties are involved other than the client ...
3
votes
2answers
301 views
Secure Software Development
I'm researching models on building security into the SDLC and so far have come across:
BSIMM
Microsoft SDL
Open SAMM
Are there any other documents and resources to look into? Specific tools that ...
1
vote
1answer
87 views
What would be good resources to conduct Technical Impact Analysis?
As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as:
https://www.owasp.org/index.php/Top_10_2010-A1
Similarly, CAPEC list impact in ...
