Re: good resources for integrating security into the Agile dev process?

I think that if your application has 99.99% security, then a sufficiently motivated and well-informed hacker need only find that 0.01% and attack that.  If that gives them root access, then they just "took" (control of) 100.00% of your system.
 

 If ONE HTML (string) output field is not properly quoted, then you are vulnerable to cross-site scripting.
 

 If ONE relational database SQL query (string type) parameter is not properly quoted, then your system is vulnerable to SQL injection.  There's no telling what the attacker might do to your data.  (... and it's probably "anything they want to.")
 

 

 

 Having said all that, I see no fundamental reason why secure development can't be incremental.  You start with nothing.  "Nothing" is secure, by virtue of the fact that you have nothing to lose.  Nothing to break into.  No process that could be compromised.
 

 Do you think that you can add one simple secure component to an already secure system?
 

 Well, there is the issue of feature interaction. But there are ways we can mitigate the risks involved in that.
 

 

 Personally, I think that the "big bang" / "all at once" / "once at the end" nature of security testing is probably more a matter of historic and current practice.  Not one of truly *best* practice.
 

 

 [I'm not an up-to-date world class expert on all of this. But I play one, on the mailing lists.  >;->  ]