Develop more secure software without sacrificing rapidity: Integrate the Security Development Lifecycle (SDL) with Agile methods

To date, there is very little guidance for development teams wanting to augment Agile methods, such as Scrum and Extreme Programming, with security discipline. After meeting with Agile proponents, the authors of The Security Development Lifecycle: A Process for Developing Demonstrably More Secure Software conclude that most of the SDL best practices and requirements can be easily incorporated into Agile practice. Furthermore, doing so can only be beneficial for developers who use Agile methods. Take a two-fold approach to integrating SDL practices with Agile methods in this sample chapter. First, examine SDL concepts and apply them to Agile methods. Then do the reverse: investigate Agile methods with regard to adding SDL concepts. Ultimately, learn when it makes sense to augment the rules and practices of Agile methods with more security discipline and best practices.

Title: The Security Development Lifecycle: A Process for Developing Demonstrably More Secure Software
ISBN: 0735622140
Published: May 2006
Authors: Michael Howard and Steve Lipner
Chapter: Chapter 18: Integrating SDL with Agile Methods
Published by Microsoft Press