Prescriptive vs. Descriptive Security: Observations on a growing paradigm shift in development security practices

Over the past decade, a variety of methods have been created to address security vulnerabilities in application software development. Generally speaking, the methods that have risen to prominence can be categorized in two ways — prescriptive methods that emphasize the use of security practices and techniques as part of a carefully monitored and repeatable security initiative, and descriptive methods that describe a set of security threats that should be addressed.