IT 项目的安全需求（一）— CLASP
IT项目需求中的有一项重要的需求就是安全需求，怎样制定安全需求，我会分两篇文章介绍两种通用的安全需求框架
第一种是CLASP
CLASP (Comprehensive, Lightweight Application Security Process) 提供一种组织良好的、结构化的方法，在软件开发生命周期的早期阶段进行安全需求的制定。
CLASP实际上是一组可以集成到任何软件开发过程中的项目活动。它被设计成既有效又容易采用。它提供了一些规定性的方法，活动，大量的安全资源，都可以是否有效的帮助我们在项目种开展这些活动。
下面这个表就是CLASP中描述的活动：
| CLASP Best Practices | CLASP Activities | Related Project Roles |
| 1. Institute awareness programs | Institute security awareness program | Project manager |
| 2. Perform application assessments | Perform security analysis of system requirements and design (threat modeling) | Security auditor |
| Perform source-level security review | Owner: security auditor Key contributor: implementer, designer | |
| Identify, implement, and perform security tests | Test analyst | |
| Verify security attributes of resources | Tester | |
| Research and assess security posture of technology solutions | Owner: designer Key contributor: component vendor | |
| 3. Capture security requirements | Identify global security policy | Requirements specifier |
| Identify resources and trust boundaries | Owner: architect Key contributor: requirements specifier | |
| Identify user roles and resource capabilities | Owner: architect Key contributor: requirements specifier | |
| Specify operational environment | Owner: requirements specifier Key contributor: architect | |
| Detail misuse cases | Owner: requirements specifier Key contributor: stakeholder | |
| Identify attack surface | Designer | |
| Document security-relevant requirements | Owner: requirements specifier Key contributor: architect | |
| 4. Implement secure development practices | Apply security principles to design | Designer |
| Annotate class designs with security properties | Designer | |
| Implement and elaborate resource policies and security technologies | Implementer | |
| Implement interface contracts | Implementer | |
| Integrate security analysis into source management process | Integrator | |
| Perform code signing | Integrator | |
| 5. Build vulnerability remediation procedures | Manage security issue disclosure process | Owner: project manager Key contributor: designer |
| Address reported security issues | Owner: designer Fault reporter | |
| 6. Define and monitor metrics | Monitor security metrics | Project manager |
| 7. Publish operational security guidelines | Specify database security configuration | Database designer |
| Build operational security guide | Owner: integrator Key contributor: designer, architect, implementer |