What is the goal of the secure implementation phase, and what are its steps and pitfalls?

Make sure the system and its security controls are developed securely. Its output is secure code, source code reviews, acceptance tests for external components, secure crypto handling and automated tests.

The Developer is responsible. Prerequisites are secure coding standards, build and test automation, SCA, SAST and DAST tools, and a secure development environment.

1. Define standards covering every language actually used.
2. Prepare the toolchain.
3. Support implementation: training and expert help for the developers.
4. Review the implementation.

Good practice: standards for all relevant languages, the same standards written into outsourcing contracts, and automate where possible. Pitfalls: "pass with errors" (findings waved through to meet a date), lack of training and lack of experts.

Go deeper:

• OWASP Cheat Sheet Series — concise secure coding guidance per topic and language