How do these three concepts fit together:
The Software Development Process (SDP) indicates the different phases of creating an application. Well known processes are waterfall, spiral, agile, extreme programming, etc.
OWASP Clasp and Microsoft SDL are process to improve the security of applications. They way I understand it is that they do not replace software development processes, but are to be integrated into them. Would I be right to assume that Clasp and SDL would have to be adapted to the chosen SDP?
And finally there are security standards, like the ISO 27000 family, and various others (NIST, BSI, IEC etc). How do these fit into the picture? Are these bigger frameworks into which the above points are embedded?