feat(next-devsecops): "Understand the Threat Model" draft

Author: PauloASilva

2019/en/src/0xb1-next-devsecops.md

@@ -3,8 +3,8 @@ What's Next For DevSecOps
 
 Due to their importance in modern application architectures, building secure
 APIs is crucial. Security can not be neglected and it should be part of the
-whole development life-cycle. Scanning and penetration testing on a yearly basis
-are not enough anymore.
+whole development life-cycle. Scanning and penetration testing yearly are not
+enough anymore.
 
 DevSecOps should join the development effort, facilitating continuous security
 testing across the entire software development life-cycle. Their goal is to
@@ -15,10 +15,12 @@ In case of doubt, better refreshing the [DevSecOps Manifesto][1].
 
 | | |
 |-|-|
-| **Understand the Threat Model** | b |
-| **Understand the SDLC** | |
+| **Understand the Threat Model** | Testing priorities come from a threat model. If you don't have one, consider using [OWASP Application Security Verification Standard (ASVS)][2] and the [OWASP Testing Guide][3] as an input. Involving the development team may help to make them more security-aware. |
+| **Understand the SDLC** | Join the development team to better understand the Software Development Lifecycle. Your contribution on continuous security testing should be compatible with people, processes and tools. Everyone should agree with the process so that there's no unnecessary friction or resistance. |
 | **Testing Strategies** | |
 | **Achieving Coverage and Accuracy** | |
 | **Clearly Communicate Findings** | Contribute value with less or no friction. Deliver findings in a timely fashion, in the tools development teams are using (not PDF files). Join the development team to address the findings. Take the opportunity to educate them, clearly describing the weakness and how it can be abused, including an attack scenario to make it real. |
 
 [1]: https://www.devsecops.org/
+[2]: https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project
+[3]: https://www.owasp.org/index.php/OWASP_Testing_Project