1. Secure Coding: SDLC Integration Sixfold Path

2. Secure Coding Requirement
Problem Set
Secure Coding Requirement
Security Organization
Development Organization
The Business

3. Landscape of Methodologies
Problem: Either too general
Or custom tailored – not
Business focused!
BSIMM
Microsoft SDL
OWASP CLASP
SAMM
AGILE
TSP-Secure
Software CBK

4. SixFold Path to Secure Coding in SDLC
Right Leaders
Security
Business
Development
Right Plan
Phased approach
Education
Developers
Business / Management
Right Process
SDLC Integration
Tools

5. SixFold Path to Secure Coding in SDLC
Right Skill sets
Language SME’s
Vulnerability Assessment / Identification
Understanding of SDLC, Project Mgmt, and Risk Mgmt
Right Policies
Right Traceability
Centralized and standardized code framework
Defect tracking of vulnerabilities
Standard reporting regardless of tool/approach
Metrics
Governance

6. Planning / Requirements
Development QA