I work as a contractor in the IS Security field. I was hired by my current client to design and enforce a methodology to make sure security risks are assessed and addressed in all IT projects. Besides this assignment, my client asked me yesterday what my knowledge of the Security by Design (SbD) concept was, if I thought it was applied in his organization and how my mission contributed to this. I honestly replied that while I had a basic understanding of what SbD is, I didn't feel comfortable giving him a definitive answer on the spot and that I would look into it.
Which I did. But it seems pretty hard to find a concrete definition of SbD. My impression is that it is - in practice, I know there is an actual and important concept behind these words - mainly used as a fashionable marketing argument people put in their presentations to please management. But are there concrete criteria to assess if a project / organization applies the SbD concept? Or is it just the idea of taking security problems into account in every aspect of the work, and letting one decide how to enforce this?