![](https://csdnimg.cn/release/download_crawler_static/22341796/bgb.jpg)
11
Inception
-Security advisor assigned
-Ensure security milestones understood
-Identify security requirements
项目启动阶段
-任命安全顾问
-设置清晰的安全里程碑
-识别安全需求
Design & Threat Modeling
-Design guidelines documented
-Threat models produced
-Security architecture documented
-Threat model and design review
completed
-Ship criteria agreed to
设计和威胁模型
-文档化的设计指南
-威胁模型分析
-文档化安全架构
-审核威胁模型和安全设计
Guidelines & Best Practices
-Coding and test standards
followed
-Test plans developed and
executed (including fuzz testing)
-Tools used (Code analysis)
指南和最佳实践
-遵循标准蚝编码和测试
-测试计划开发和执行
-代码分析工具的使用
Final Security Review (FSR)
-Threat models reviewed
-Unfixed bugs reviewed
-New bugs reviewed (postmortem)
-Penetration testing completed
-Documentation archived
最终安全审核
-重新审核威胁模型
-审核未修正的BUG
-审核新BUG
-完成渗透测试
-完成相关文档
RTM & Deployment
-Signoff by security team
生产和部署
-安全团队签名确认
Security Response Feedback
-Tools/processes evaluated
-Postmortems completed