A new, free 22-page report from SAFECode discussses best practices across the secure development lifecycle in a pithy, pragmatic way. A new 22-page report, “Fundamental Practices for Secure Software Development: A Guide to the Most Effective Secure Development Practices in Use Today,” has just been released by SAFECode, an industry-led association focused on advancing software assurance. The report, available for free as a PDF at SAFECode’s Web site, was written by Michael Howard of Microsoft and 15 coauthors from EMC, Juniper, Microsoft, Nokia, SAP, and Symantec.I’ve been through this report, and I’m impressed at how much good content and good references has been crammed into such a short paper. The paper:“describes each identified security practice across the software development lifecycle – Requirements, Design, Programming, Testing, Code Handling and Documentation – and offers implementation advice based on the experiences of SAFECode members. The secure development practices defined in the paper are as diverse as the SAFECode membership, spanning web-based, shrink-wrapped and database applications, as well as operating systems and embedded systems.”If you’re involved in software development at all, this paper is at least worth skimming. Software Development