In this chapter, we discussed security practices from different perspectives based on the OWASP SAMM framework. We discussed security activities in different roles such as security management, development, QA, and operation teams.
First, from the security management perspective, there are organization goals, policies, and education. We use GDPR compliance as an example to show what can be planned in security management.
For a development team, key security activities include threat assessment, security requirements, and secure architecture and coding. Although secure coding is also considered critical in the development stage, we moved the discussion to the secure code verification phase. In terms of threat assessment, we introduced some industry tools, best practices, and even card games. We used GDPR privacy assessment as an example to explain how to execute the PIA...
