Building Secure Software, [103] Cigital’s Gary McGraw and John Viega suggest
the following activities as the components of a security risk management
process within the SDLC (versus the software operational life cycle):
u Security requirements derivation/elicitation and specification (Section 5.2)