Intelligence
Creating corporate knowledge used in software security activities throughout the organization.
Practices that result in collections of corporate knowledge used to carry out software security activities, including both proactive security guidance and organizational threat modeling.
Attack Models
Attack Models capture information used to think like an attacker: threat modeling, abuse case development and refinement, data classification, and technology-specific attack patterns.
Learn moreSecurity Features & Design
The Security Features & Design practice is charged with creating usable security patterns for major security controls (meeting the standards defined in the Standards and Requirements practice), building middleware frameworks for those controls, and creating and publishing other proactive security guidance.
Learn moreStandards & Requirements
The Standards & Requirements practice involves eliciting explicit security requirements from the organization, determining which COTS to recommend, building standards for major security controls (such as authentication, input validation, and so on), creating security standards for technologies in use, and creating a standards review board.
Learn more