Interesting to see is how much is not about actual coding, but of tooling, testing, processes, operations and mindset.
[WayBack] SAFECode updates its guide on best secure software development practices – SD Times
PDF: [WayBack] SAFECode releases Fundamental Practices for Secure Software Development: Essential Elements of a Secure Development Life Cycle Program (Third Edition).
Table of Contents:
Page;Topic
4; Executive Summary
5; Introduction
5; Audience
6; SAFECode Guidance and Software Assurance Programs
7; Application Security Control Definition
7; Actively Manage Application Security Controls
9; Design
9; Secure Design Principles
10; Threat Modeling
11; Develop an Encryption Strategy
12; Standardize Identity and Access Management
14; Establish Log Requirements and Audit Practices
15; Secure Coding Practices
15; Establish Coding Standards and Conventions
15; Use Safe Functions Only
17; Use Code Analysis Tools To Find Security Issues Early
17; Handle Data Safely
20; Handle Errors
21; Manage Security Risk Inherent in the Use of Third-party Components
22; Testing and Validation
22; Automated Testing
24; Manual Testing
27; Manage Security Findings
27; Define Severity
28; Risk Acceptance Process.
29; Vulnerability Response and Disclosure
29; Define Internal and External Policies
29; Define Roles and Responsibilities
30; Ensure that Vulnerability Reporters Know Whom to Contact
30; Manage Vulnerability Reporters
30; Monitor and Manage Third-party Component Vulnerabilities
31; Fix the Vulnerability
31; Vulnerability Disclosure
32; Secure Development Lifecycle Feedback
33; Planning the Implementation and Deployment of Secure Development Practices
33; Culture of the Organization
33; Expertise and Skill Level of the organization
34; Product Development Model and Lifecycle
34; Scope of Initial Deployment
35; Stakeholder Management and Communications
35; Compliance Measurement
36; SDL Process Health
36; Value Proposition.
37; Moving Industry Forward
37; Acknowledgements
38; About SAFECode
–jeroen
The Wiert Corner - irregular stream of stuff 