Process Activities Supporting Security Principles

Security principles, like least privilege, are among the few resources in the body of knowledge for security that survived the test of time. Over the last few years, several secure software development processes have emerged that mention security principles and acknowledge their importance. Nevertheless, support for principles in security processes does not appear to be satisfactory. This paper analyzes a forefront security process (CLASP) and elicits both explicit and hidden relationships between process activities and security principles.