Software Development Security

Integrating security activities (requirements, threat modeling, testing) as early as possible in the development life cycle rather than bolting them on at the end, because defects are far cheaper to fix early.

Initiation/requirements, design, development (coding), testing/verification, deployment/implementation, and operations & maintenance, followed by disposal/decommissioning.

Threat modeling — systematically identifying assets, threats, and countermeasures (e.g., STRIDE) before code is written.

A linear, sequential model where each phase (requirements, design, implementation, testing, maintenance) completes before the next begins; rigid with little backtracking, suited to stable, well-understood requirements.

Iterative, incremental development in short sprints with continuous customer collaboration, working software over documentation, and adaptability to changing requirements.

A risk-driven iterative model that repeats four quadrants (objectives, risk analysis, engineering, planning) in successive spirals, performing risk assessment in each iteration.