C706 - SECURE SOFTWARE DESIGN 2023/24 UPDATE

ISO/IEC 27034-1:2011 A standard for application security which offers a concise, internationally recognized way to get transparency into a vendor/supplier's software security management process ISO/IEC 27034 standard provides guidance to help organizations embed security within their processes that help secure applications running in the environment, including application life cycle processes. Trustworthy Computing Security Development Lifecycle The most widely used security development lifecycle, Primary Dataflow A type of functional security requirement involves receiving, processing, storing, transmitting, and delivering in report form. Logging A nonfunctional security requirement provides a way to capture information correctly and a way to store that information to help support later audits Nonfunctional Acceptance Criteria Due Care When a company practiced common sense and prudent management and acted responsibly. Practising the individual activities that main-tain the due diligence effort. The continued application of this security structure onto the IT infrastructure of an organization. Due Diligence When a company has properly investigated all of its possible weaknesses and vulnerabilities. Establishing a plan, policy, and process to protect the interests of an organization. Developing a formalized security structure containing a security policy, standards, baselines, guidelines, and procedures. Security Champion A member of a group who decides (or is assigned) to take charge of leading the adoption and integration of security concepts into the group's work activities. Security champions are often non-security employees who take up the mantle to encourage others to support and adopt more security practices and behaviors. Fail-Secure Failure condition that occurs during an emergency, in which the security mechanisms fail to a secure mode rather than a safe mode. An example of this would be a secure door lock that is kept locked during an emergency, ensuring that valuable assets and data are protected. Fail-Open System default that allows access during a system or network failure. Strategic Plan A long-term plan that is fairly stable. It defines the organization's security purpose. It defines the security function and aligns it to the goals, mission, and objectives of the organization. It's useful for about five years, if it is maintained and updated annually. Tactical Plan A midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan, or can be crafted ad hoc based on unpredicted events. A tactical plan is typically useful for about a year and often prescribes and schedules the tasks necessary to accomplish organizational goals. Operational Plan A short-term, highly detailed plan based on the strategic and tactical plans. It is valid or useful only for a short time. This plan must be updated often (such as monthly or quarterly) to retain compliance with tactical plans. Operational plans spell out how to accomplish the various goals of the organization. They include resource allotments, budgetary requirements, staffing assignments, scheduling, and step-by-step or implementation procedures. Documentation Review Investigate the means by which datasets and documentation are exchanged as well as the formal processes by which they perform assessments and reviews. On-Site Assessment Visit the site of the organization to interview personnel and observe their operating habits. Process/Policy Review Request copies of their security policies, processes/procedures, and documentation of incidents and responses for review.