I agree with you. Security takes discipline, regardless of methodology. Interestingly, the only freely-available security-focused method I've seen is Microsoft'

I agree with you. Security takes discipline, regardless of methodology. Interestingly, the only freely-available security-focused method I've seen is Microsoft's SDL (waterfall)[1]. The article does spark some interesting debate though, also about TDD. [1] http://www.microsoft.com/security/sdl/default.aspx http://www.microsoft.com/security/sdl/default.aspx