Discussion: Threat Modeling
The SDLC (software/system development life cycle) framework, where security is often addressed only during the testing phase, is sometimes used by organizations. However, that practice has many flaws, especially the failure to identify threats and/or vulnerabilities because testing is done so late in the framework.
How can you include threat modeling within your SSDLC? At what points of the lifecycle would you include threats? Why would you do it then instead of another phase?
The response must include a reference list. Using Times New Roman 12 pnt font, double-space, one-inch margins, and APA style of writing and citations.