How security is handled in the development life cycle is frequently a reflection of the industry and its conventional or dictated development methodologies. Some product types, such as aircraft or cars, are simply not amenable to pure Agile development methodologies, because of the complexity and dependencies built into their supply chains, and the absolute nature of the intermediate and final delivery dates of their products.
Regardless, in many cases, development organizations do have some latitude when selecting a development methodology. This section spells out common development approaches and provides guidance on implementing security rigor within those approaches.
When selecting a development methodology, building security in from the beginning means that well-thought-out security, safety, and privacy requirements are elicited...
