Chapter1 – Introduction
Discusses the critical importance of building software security into
the development process. Emphasizes that software is foundational to
modern infrastructure, and that defects introduced during coding are costly
and often unfixable post-release. The chapter differentiates between
software security (built-in) and application security (post-release
protection) and stress-tests conventional assumptions about quality vs
security. It sets the stage for the authors’ SDL framework grounded in
people-centric best practices and metrics. PagePlace+1eBay+1
Chapter2 – The Security Development Lifecycle (SDL)
Introduces the authors’ tailored SDL, mapping best practices from models
like Microsoft SDL, NIST, ISO, and SAFECode into a cohesive reference
framework. It outlines the need for measurable metrics, alignment across
SDLC methodologies (waterfall, agile), and embedding least-privilege
principles. This chapter presents how organizations can operationalize secure
development in ways that scale. Taylor & Francis PagePlace
Chapters3 to8: SDL Phases A1–A5 and PRSA
Chapter3 – A1: Security Assessment
Focuses on early-stage assessment, including discovery sessions, risk
identification, compliance scoping, and threat modeling initiation.
Emphasizes setting up project plans, baseline control frameworks, and
relevant metrics like the number of findings and scope coverage. It
introduces how to embed preventive and detective controls even before
architecture begins. Scribd+12Taylor & Francis+12ResearchGate+12
Chapter4 – A2: Architecture
Covers high-level architectural design, threat modeling (STRIDE, data
flow diagrams), and defining architectural security controls. The chapter
walks through threat ranking, selection of preventive and compensating
controls, and artifacts like security-enhanced architecture diagrams and
remediation plans. Metrics may include coverage ratios and residual risk
estimates. ResearchGate Taylor & Francis
Chapter5 – A3: Design & Development
