So let's take a look at the corresponding need for systems design and engineering, and the standards that bring those things about. Now, we have several internationally recognized standards that embody the design considerations when we talk about secure development. Some of these have been present for a number of years. Some of them are relatively recent. But all of them focus on better system design through better requirements, design engineering, build, test, and deployment. We have the ISO 15504, which has to do with the process assessment. And originally called SPICE, this lays out a Capability Maturity Model-type scale specifically targeting process evolution and its continuous improvement.

We have the well-known ISO 15408, known as the common criteria. And this is a testing and evaluation standard that is used to determine the functionality and the assurance qualities of the given product. NIST with its special publication Series 500, which is at the moment predominantly about cloud, but it has two volumes on development and code testing. Then we have the far more voluminous Series 800, which is predominantly about security engineering and technology, but also contains numerous volumes on architecture and the various standards to be employed when designing and building software. We have an industry consortium known as SAFECode, which is committed to capturing and communicating to all members practices that are picked up and proven to be well and rounded and adequate to meet the needs of secure development and deployment of systems in order to make them much more pervasive, and much more widely practiced within the profession.