Security assurance program

We will discuss the security assurance program by introducing some industry practices such as SDL, OWASP SAMM, and ISO 27001. SDL lists security activities through the whole development lifecycle. OWASP SAMM explains three levels of maturity to apply security practices in four different functional roles. ISO 27001 is considered the foundation of security certification standards and gives an overview of what a security management program should be. 

SDL (Security Development Lifecycle)

Microsoft defines the SDL (Security Development Lifecycle) to help developers to build secure software. The security activities in each development phase are shown in the following table: 

MS SDL Stages	Security activities
Training	Core security training
Requirements	Establish security requirements Create quality gates/bug bars Perform security and privacy risk assessments
Design	Establish design requirements Perform attack surface analysis reduction Use threat modeling
Implementation	Use approved...