In April I published a mapping of the SOC 2 Type 2 Common Criteria to Secure SDLC requirements. That article answers the question “which criterion touches which SDLC phase”. This one answers the question that comes right after it in every readiness project: how does the auditor actually test each criterion, and what makes a […]
Introduction This is the very first article from a series of articles that will be merged with the existing SDLC Process “From Idea to Proof of Concept to MVP” previously written, finally to be rewritten in an AI-Native SDLC. What is an “AI-Native” organization? “AI-Native” describes an organization that has restructured how it works […]
Software Delivered the Same Way Every Time Before security enters the picture, SDLC exists to solve a simpler problem: making software delivery repeatable. A team that builds features ad hoc, without a defined sequence of requirements, design, coding, testing, and release, ends up with wildly inconsistent outcomes — some releases solid, others full of regressions, […]
I wrote some time ago about “How to create security user stories” and I received in the meanwhile a lot of good feedback and questions about it. For these reasons, I decided that it is time to write again on the topic, this time with focus on two importat groups in any software developer team: […]
We started to talk about the SOC2 Type 2 certification and I feel that we neglected it a bit. I wrote a bit about SDLC, Secure SDLC in particular, but now it is time to bring them together. SOC 2 Type 2 and Secure SDLC — the big picture SOC 2 Type 2 evaluates whether […]
In the previous article, we explored how Scrum enables teams to add security to the backlog and prioritize it based on risk. Incorporating security into the SDLC ensures that security is not an afterthought but an integral part of the development process. Security User Stories are specific, actionable items that articulate the security needs of […]
While I was looking after some resources for a presentation, I found this interesting lecture from ENISA. Advancing Software Security in the EU Download PDF document, 622 KB This study discusses some key elements of software security and provides a concise overview of the most relevant existing approaches and standards while identifying shortcomings associated […]
I get very often asked about these two concepts and I noticed that there is a lot of unclarity around these topics. At the end, I will tell you my own opinion and give you some advices. Vulnerability scan Also known as Vulnerability Assessment, looks for known vulnerabilities in your systems and reports potential […]
You must be logged in to post a comment.