3. Development—Code reviews, use of security patterns, flaw and bug
mitigation, unit security testing, update of threat models, and security
measurements (Section 5.4)
4. Testing—Use of attack patterns, automated black box and white