University Homepage School Homepage School Contacts School Search

Secure Programming Lecture 9: Secure Development

References and credits

Material in this lecture is adapted from

• Software Security: Building Security In, by Gary McGraw. Addison-Wesley, 2006.
• The Art of Software Security Testing, by Wysopal, Nelson, Dai Zovi and Dustin. Addison-Wesley, 2007.
• Build Security In, the initiative of US-CERT at https://buildsecurityin.us-cert.gov/.

Recommended reading

• This summary of Secure Software Development Life Cycle Processes at US-CERT. See more pointers via Cigital's blog.
• Microsoft's STRIDE approach documented in the MSDN magazine, Nov 2006 (NB currently only available in a MS chm format)
• Saltzer and Shroeder. The Protection of Information in Computer Systems. Several versions (1973-1975). Web version available at MIT Proceedings of IEEE version at IEEE Explore.

See also the Building Security In Maturity Model BSIMM and the pointers for it given in Lecture 2.