SDL Activities

Software security team looped in early (Activity for SDL Phase)

A1

Software security hosts a discovery meeting (Activity for SDL Phase)

A1

Software security team creates an SDL project plan (Activity for SDL Phase)

A1

Privacy Impact Assessment (PIA) plan initiated (Activity for SDL Phase)

A1

Policy Compliance Analysis: Initial Analysis (Activity for SDL Phase)

A2

SDL policy assessment and scoping (Activity for SDL Phase)

A2

Threat modeling / architecture security analysis (Activity for SDL Phase)

A2

Open-source selection (Activity for SDL Phase)

A2

Privacy information gathering and analysis (Activity for SDL Phase)

A2

Policy Compliance Analysis: Updates (Activity for SDL Phase)

A3

Security test plan composition (Activity for SDL Phase)

A3

Threat model updating (Activity for SDL Phase)

A3

Design security analysis and review (Activity for SDL Phase)

A3

Privacy implementation assessment (Activity for SDL Phase)

A3

Static analysis (Activity for which TWO SDL Phases)

A3, A4

Policy Compliance Analysis: Compliance review (Activity for SDL Phase)

A4

Security test case execution (Activity for SDL Phase)

A4

Code review (Activity for SDL Phase)

A4

Dynamic analysis (Activity for SDL Phase)

A4

Fuzz testing (Activity for SDL Phase)

A4

Manual code review (Activity for SDL Phase)

A4

Privacy validation and remediation (Activity for SDL Phase)

A4

Policy Compliance Analysis: Final Analysis (Activity for SDL Phase)

A5

Vulnerability scan (Activity for SDL Phase)

A5

Code-assisted penetration testing (Activity for SDL Phase)

A5

Open-source licensing review (Activity for SDL Phase)

A5

Final security review (Activity for SDL Phase)

A5

Final privacy review (Activity for SDL Phase)

A5