Part II of Gary McGraw’s Software Security: Building Security In (AddisonWesley, 2006) is devoted to describing “Seven Touchpoints for Software
Security” (see Figure 5-5), which are “lightweight” best practices to be applied
to various software development artifacts. (He uses artifacts, rather than life
cycle phases, as the basis for his touchpoints to ensure that they are as processagnostic as possible.) He numbers these practices—or touchpoints—according