This interesting InfoWorld article makes a lot of useful observations about security issues in the Agile process. The way Agile practitioners feel their way through the design doesn't seem like a good way to approach some of the difficult up-front security requirements that extend across sprints. The biggest problems might be at the birth of an application, when many architectural decisions happen (or get postponed).
The article got me thinking a bit about building Agile teams to address security issues for an already-released product. New security threats require rapid responses, often requiring flexibility and creativity to handle. Work from this team will have to be folded into the core product, but then it becomes just another set of entries in the burndown list.
Comments