Development goal/metrics
The security goal of a development team is to deliver secure design and implementation. Based on OWASP SAMM practices, there are three key aspects to consider during the construction phase:
- Threat assessment
- Security requirements
- Secure architecture
Although design and implementation review is normally also part of the development team's activities, we will take these into consideration in further discussions.
Threat assessment
To have an effective threat assessment, the following guideline or templates are suggested for the project team:
Threat Modeling tools/templates | Rationale and purpose |
Knowledge-base of threats and mitigation | Threat and mitigation knowledge can help the team to decide what's most relevant to the project from the knowledge list instead of starting from zero. For example, CAPEC or ATT&CCK are also good references. |
Tools or threat modeling templates | A template or tool can enable the team to deliver consistent quality for threat modeling reports. |
In addition...
