On the secure software development process: CLASP, SDL and Touchpoints compared

Information and Software Technology

Volumn 51, Issue 7, 2009, Pages 1152-1171

  De Win, Bart ^a   Scandariato, Riccardo ^a   Buyens, Koen ^a   Grégoire, Johan ^a   Joosen, Wouter ^a  

^a UNIVERSITY OF LEUVEN   (Belgium)

Author keywords

CLASP; SDL; Secure software; Software process; Touchpoints

Indexed keywords

CLASP; SDL; SECURE SOFTWARE; SOFTWARE PROCESS; TOUCHPOINTS;

SOFTWARE ENGINEERING;

ENGINEERING RESEARCH;

EID: 67349139935     PISSN: 09505849     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.infsof.2008.01.010     Document Type: Article

References (22)

1. Howard M., and Lipner S. The Security Development Lifecycle (SDL): A Process for Developing Demonstrably More Secure Software (2006), Microsoft Press
2. OWASP, Comprehensive, lightweight application security process, http://www.owasp.org, 2006.
3. McGraw G. Software Security: Building Security (2006), Addison Wesley
4. MSDN: Security development lifecycle phases, http://msdn2.microsoft.com/en-us/library/ms995349.aspx, 2005.
5. Information technology security techniques evaluation criteria for it security, standard ISO/IEC 15408 (2005).
6. Nuseibeh B. Weaving together requirements and architectures. IEEE Computer 34 3 (2001) 115-117. URL://citeseer.ist.psu.edu/nuseibeh01weaving.html
7. Microsoft threat modeling tool 2.1.2, http://www.microsoft.com/downloads/details.aspx?familyid=59888078-9daf- 4e96-b7d1-944703479451, 2007.
8. Davenport T. Process Innovation: Reengineering Work Through Information Technology (1993), Harvard Business School Press, Boston
9. Jacobson I., Booch G., and Rumbaugh J. The Unified Software Development Process (1999), Addison-Wesley
10. Beck K. Extreme Programming Explained (1999), Addison-Wesley
11. Systems security engineering capability maturity model (SSE-CMM), standard ISO/IEC 21827, 2006.
12. Jaquith A. Security Metrics: Replacing Fear, Uncertainty, and Doubt (2007), Addison-Wesley Professional
13. Saltzer J.H., and Schroeder M.D. The protection of information in computer systems. Proceedings of the IEEE 63 9 (1975) 1278-1308
14. Viega J., and McGraw G. Building Secure Software: How to Avoid Security Problems the Right Way (2002), Addison-Wesley
15. G. Stoneburner, C. Hayden, A. Feringa, Engineering principles for information technology security, NIST Special Publication 800-27, Revision A, 2004.
16. Build security in, http://buildsecurityin.us-cert.gov/, 2007.
17. G. Peterson, Collaboration in a secure development process, http://www.arctecgroup.net/articles.htm (June 2004).
18. Hall A., and Chapman R. Correctness by construction: developing a commercial secure system. IEEE Software 19 1 (2002) 18-25. URL://citeseer.ist.psu.edu/hall02correctness.html
19. K. Goertzel, T. Winograd, H. McKinley, L. Oh, M. Colon, T. McGibbon, E. Fedchak, R. Vienneau, Software security assurance: A state-of-art report (soar), Tech. rep., Information Assurance Technology Analysis Center (IATAC), 2007.
20. Howard M., and Leblanc D.E. Writing Secure Code (2002), Microsoft Press, Redmond, WA, USA
21. D. Wheeler, Secure programming for linux and unix howto, http://citeseer.ist.psu.edu/wheeler00secure.html.
22. K. Buyens, J. Gregoire, B.D. Win, R. Scandariato, W. Joosen, Similarities and differences between clasp, sdl, and touchpoints: the activity-matrix, Tech. rep., K.U. Leuven, Department of Computer Science (October 2007).