In this paper we have presented an overview of a process designed to help software development or- ganizations prevent vulnerabilities in the software they develop. The process is flexible, straightforward and well adapted to the needs of most businesses. We have described key components (vulnerability modeling and cause mitigation analysis) in earlier work; this paper fo- cuses on how to apply the process and the criteria that have influenced the process design.
The process is applied throughout the entire soft- ware lifecycle as an adjunct to the software development process. It can be used together with any software devel- opment process – from requirements-driven to agile. As new risks and vulnerabilities are identified, or the devel- opment organization changes, the software security pro- cess is used to adjust and adapt the development process to these new conditions.