en:cs:quality_report

Différences

Ci-dessous, les différences entre deux révisions de la page.

Lien vers cette vue comparative

Les deux révisions précédentes Révision précédente
Prochaine révision		 Révision précédente
en:cs:quality_report [2018/02/11 22:00] – [Corporate requirements] fraggleen:cs:quality_report [2018/06/03 20:47] – [List of Product Standard Requirements] fraggle
Ligne 210: Ligne 210:
 ==== Role of the Product Standard Security requirements ==== ==== Role of the Product Standard Security requirements ====
  
-By introducing the risk-based secure Software Development Lifecycle the product standard security acts as product security knowledge base containing best practices of secure software development and as a threat-library for the program specific risk assessment. The question whether a program needs to comply with a product standard requirement or not depends on the underlying risk that was identified and rated during the risk assessment.  According to the lean governance concept the Product Owner is responsible to ensure an adequate security level in the product by managing risks and mitigations diligently. As a consequence a program can decide which risks can be accepted and which risks need to be partlxy or full mitigated, as long corporate requirements are not violated.+By introducing the risk-based secure Software Development Lifecycle the product standard security acts as product security knowledge base containing best practices of secure software development and as a threat-library for the program specific risk assessment. The question whether a program needs to comply with a product standard requirement or not depends on the underlying risk that was identified and rated during the risk assessment.  According to the lean governance concept the Product Owner is responsible to ensure an adequate security level in the product by managing risks and mitigations diligently. As a consequence a program can decide which risks can be accepted and which risks need to be partly or full mitigated, as long corporate requirements are not violated.
  
 In case of corporate violations in addition an exceptional approval needs to be requested. In case of corporate violations in addition an exceptional approval needs to be requested.
  
-Links to the requirements are provided in the table below ordered by relevant security topics. In addition, further columns of the table indicate if a requirement belongs to (A) Regulatory Compliance (B) Vulnerability Prevention (C) Strategy and Reduction of Attack Surface.+List of the requirements is provided in the table below ordered by relevant security topics. In addition, further columns of the table indicate if a requirement belongs to (A) Regulatory Compliance (B) Vulnerability Prevention (C) Strategy and Reduction of Attack Surface.
  
 ==== List of Product Standard Requirements ==== ==== List of Product Standard Requirements ====
Ligne 275: Ligne 275:
 | SEC-244 - Deliver with a secure default configuration | | |X|  | SEC-244 - Deliver with a secure default configuration | | |X| 
 | SEC-275 - Enforce address space layout randomization, executable space protection and buffer overflow protection | | |X|  | SEC-275 - Enforce address space layout randomization, executable space protection and buffer overflow protection | | |X| 
-| Secure-by-design | | | |+| **Secure-by-design** | | | |
 | SEC-219 - Provide a risk-adequate second line of defense against malicious input from the Internet | | |X|  | SEC-219 - Provide a risk-adequate second line of defense against malicious input from the Internet | | |X| 
 | SEC-228 - Protect upload, download and display functions of untrusted files against MIME-type sniffing and virus attacks | | |X|  | SEC-228 - Protect upload, download and display functions of untrusted files against MIME-type sniffing and virus attacks | | |X| 
  • en/cs/quality_report.txt
  • Dernière modification : il y a 2 ans
  • de 127.0.0.1