Software Security Engineering - Build Security In - US-CERT

More documents

Recommendations

Info

Planning for Software Security • Some questions to aid in understanding security risks to achieving project goals and objectives: • What is the value we must protect? • To sustain this value, which assets must be protected? Why must they be protected? What happens if they’re not protected? • What potential adverse conditions and consequences must be prevented and managed? At what cost? How much disruption can we stand before we take action? • How do we determine and effectively manage residual risk (the risk remaining after mitigation actions are taken)? • How do we integrate our answers to these questions into an effective, implementable, enforceable security strategy and plan? • Help you determine how much to invest, where to invest, and how fast to invest in an effort to mitigate software security risk. © 2008 Cigital Inc. All Rights Reserved. Thursday, November 06, 2008 16
What makes software secure? © 2008 Cigital Inc. All Rights Reserved. Thursday, November 06, 2008 17
Page 1 and 2: Software Security Engineering Softw
Page 3 and 4: So What Is Software Security? Softw
Page 5 and 6: Build Security In: A Key Resource
Page 7 and 8: Why is Security a Software Issue?
Page 9 and 10: The Problem • Organizations incre
Page 11 and 12: Software that has been developed wi
Page 13 and 14: Software Security Always Has a Cost
Page 15: The Risk Management Framework • B
Page 19 and 20: Core Properties of Secure Software
Page 21 and 22: Influencing the Security Properties
Page 23 and 24: Addressing the Expected: Security A
Page 25 and 26: Addressing the Unexpected: Avoiding
Page 27 and 28: The Attacker’s Perspective • As
Page 29 and 30: Parting Thoughts on Secure Software
Page 31 and 32: SDLC With Defined Security Touchpoi
Page 33 and 34: Assess Security Risk Across the SDL
Page 35 and 36: Maturity Indicators Maturity Level
Page 37 and 38: Software Security Practices That Sp
Page 39 and 40: Software Security Practices That Sp
Page 41 and 42: Requirements Engineering Practices
Page 43 and 44: Architecture and Design Practices 2
Page 45 and 46: Coding and Testing Practices 2 Prac
Page 47 and 48: Coding and Testing Practices 4 Prac
Page 49 and 50: Security Analysis for System Comple
Page 51 and 52: Security Analysis for System Comple
Page 53 and 54: Governance and Management Practices
Page 55 and 56: Governance and Management Practices
Page 57 and 58: Recommendations Treat software secu
Page 59: Contact Information Sean Barnum Pri

Software Security Engineering - Build Security In - US-CERT

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?