Should we define the security mechanisms and techniques that will be used in order to mitigate the security risks during the requirement phase or design phase

(Such as deciding to use the S/MIME protocol to encrypt the transferred messages)

1 Answer 1


It all depends on the the software development method you choose as some methods are more risk management driven than others; but in general, each method has a set of activities gathered under the name of RMP (risk management plan) that can be divided into:

  • Risk identification
  • Qualitative risk analysis
  • Quantitative risk assessment
  • Risk response planning
  • Risk monitoring and control

These activities are present during the whole software life cycle. As for the security mechanisms and techniques you asked about, they generally take place during the design phase.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .