Over the past few years Herbert Thompson and his cohorts have scoured bug databases for the most malevolent and destructive security bugs ever to infest a released binary. Through that search they found that common characteristics and habits emerged-creating temporary files with secure data, trusting that system calls will succeed, foolishly relying on insecure third party components, and many others. In this session, he offers a startling and even scary accounting of the top seven habits of insecure software. Take away a red-teaming strategy that has broken some of the world's most secure software under testing contracts with Microsoft, IBM, the US DoD, and many others. Use this approach to make your software more secure, and you can sleep better at night.

• The differences between security defects and other common errors
• An intimate understanding of security faults as seen by hackers

Whether you are using the Rational Unified Process (RUP), agile methods, spiral development, or a home grown iterative approach, there are some fundamental practices that can make a big difference. Esther Derby looks at ways to manage schedules and resources, keep progress visible, mitigate risk, and dynamically improve estimates throughout the project. After comparing and contrasting popular iterative process models, Esther offers practical, easy to implement practices to enhance your current process. You will take away some process "gems" that she has collected in her consulting practice, including: use of product backlogs for driving ownership and priorities, burn down charts, ROI measures of requirements, and ways to obtain vital feedback at every iteration.

• The advantages and disadvantages of different iterative development models
• A return on investment (ROI) measure for more detailed requirements

Through the application of a rigorous measurement model, which includes both quantitative and qualitative analysis, organizations can identify high impact areas of software development performance. With these organizational practices identified, you can more effectively align process improvement programs and realize significant gains in productivity and quality. Using three case studies, David Herron describes what leading organizations are doing to reduce costs and to produce higher quality deliverables. One company was able to measure and model the impact of an SEI CMM®-based process improvement program to analyze performance results from the program. Another organization quantitatively compared practices of high versus low performance projects to identify the factors contributing to better results. A third company used qualitative and quantitative analysis techniques to model performance and identify their best practices.

Scrum is an agile, lightweight and team-based process to manage software and product development within iterative software development lifecycles. By wrapping around existing engineering practices such as XP or RUP, Scrum generates many benefits of agile development with the advantages of simple implementation. Properly understood and implemented, Scrum significantly increases productivity and facilitates adaptive, pragmatic systems development. Scrum is a proven way to improve communications, increase cooperation, and remove things that get in the way of delivering products. Brad Grant, a Certified ScrumMaster, shares his knowledge and experiences facilitating stakeholder involvement with Scrum and improving the engineering practices of development teams. Join Brad to discover the roles, practices, team dynamics, and metrics that make up Scrum projects, and find out if Scrum is right for your team.