From auditor-centric to architecture-centric: SDLC for PCI DSS

Abstract

This paper examines ways to improve security architecture by harnessing the executive attention that compliance activities like PCI DSS bring to security and focus that attention toward improving security architecture over the long term. Threat modeling fills a gap between the system's functional requirements and the auditor's checklist, and is used to catalyze this change of focus.