This textbook explains developer-centric software security, a holistic process to engage security. As long as software is developed by humans, it requires the human element to fix it. It outlines a step-by-step process for software security that is focused on educating graduate and undergraduate students.

James Ransome, PhD, CISSP, CISM is the Chief Scientist for CYBERPHOS, an early-stage cybersecurity startup. He is also a member of the board of directors for the Bay Area Chief Security Officer Council. Most recently, James was the Senior Director of Security Development Lifecycle Engineering for Intel¿s Product Assurance and Security (IPAS). In that capacity, he led a team of SDL engineers, architects, and product security experts to drive and implement security practices across the company. Prior to that, James was the Senior Director of Product Security and PSIRT at Intel Security (formerly McAfee).

Anmol Misra is an accomplished leader, researcher, author, and security expert, with over 16 years of experience in technology and cybersecurity. His engineering, security, and consulting background makes him uniquely suited to drive the adoption of disruptive technologies. He is a team builder focused on mentoring and nurturing high-potential leaders, fostering excellence, and building industry partnerships. He is known for his pragmatic approach to security.

Mark S. Merkow, CISSP, CISM, CSSLP has over 25 years of experience in corporate information security and 17 years in the AppSec space helping to establish and lead application security initiatives to success and sustainment. Mark is a faculty member at the University of Denver, where he works developing and instructing online courses in topics across the Information Security spectrum, with a focus on secure software development. He also works as an advisor to the University of Denver¿s Information and Computing Technology Curriculum Team for new course development and changes to the curriculum and for Strayer University as an advisor to the undergraduate and graduate programs in information security.

1. Introduction 2. The Security Development Lifecycle 3. Security Assessment (A1): SDL Activities and Best Practices 4. Architecture (A2): SDL Activities and Best Practices 5. Design and Development (A3): SDL Activities and Best Practices 6. Design and Development (A4): SDL Activities and Best Practices 7. Ship (A5): SDL Activities and Best Practices 8. Post-Release Support (PRSA1¿5) 9. Adapting Our Reference Framework to Your Environment A. Case Study for Chapters 3 Through 8 Exercises B. Answers to Quick-Check Questions