Core Concepts

Security Design Principles

Define Software Security Needs

Determine and Examine Compliance Requirements

Determine and Analyze Data Classification Needs

Identify and Analyze Privacy Needs

Create Cases of Misuse and Abuse

Create a Security Traceability Matrix (STRM).

Check for Security Requirements Suppliers/Providers are the ones who benefit from the flow down.

Define the Security Architecture Designing Secure Interfaces Modelling Architectural Risk Assessment (Non-Functional) Constraints and Security Properties

Model and categorize data; evaluate and choose reusable secure designs; and carry out security architecture and design reviews.

Define the Secure Operational Architecture (for example, deployment topologies and operational interfaces).

Implement secure architecture and design principles, patterns, and tools.

Follow Secure Coding Best Practises (e.g., standards, guidelines, and regulations)

Examine the code for security flaws.

Implement security controls (for example, watchdogs, FIM, and anti-malware).

Address security risks (for example, cleanup, mitigation, transfer, and acceptance).

Reuse Third-Party Code or Libraries Securely (e.g., Software Composition Analysis (SCA))

Integrate Components Safely

Apply Security During the Construction Process

Create Security Test Cases

Plan and develop a security testing strategy.

Validate and verify documentation (for example, installation and setup instructions, error messages, user manuals, and release notes).

Recognise Undocumented Functionality

Analyse the security implications of test results (for example, the influence on product management, prioritization, and break build criteria).

Security flaws must be classified and tracked.

Safeguard Test Data

Verification and validation testing should be carried out.

Version Control and Secure Configuration (e.g., hardware, software, documentation, interfaces, patching)

Create a strategy and a road plan.

Control security as part of a software development methodology.

Determine Security Frameworks and Standards

Defining and Creating Security Documentation

Create security metrics (for example, defects per line of code, criticality level, average remediation time, and complexity).

Decommission Software Report Status of security (e.g., reports, dashboards, feedback loops)

Implement Integrated Risk Management (IRM).

Encourage a Secure Culture in Software Development

Implement Continuous Improvement (for example, a retrospective and lessons learned).