Security How robust are the security Please consider RADIO BUTTONS: 5 Optimized: Participates in – controls for the application? integration with enterprise enterprise identity identity management management; enforces all Label: “5 – databases including credential requirements and Value: 5 Optimized”, integration with single policies; properly implements sign-on; enforcement of role-based access control; 4 Label: Value: “4 – Strong”, required credentials passes all security tests; across all user and actively logs and monitors system roles; adherence activity with event-based Label: “3 – to role-based access notifications Value: 3 Sufficient”, control or other regulated authorization; the use of 3 Sufficient: Contains an Label: – “2 – penetration, injection, and internal identity database that Value: 2 Vulnerable”, other dynamic/static adheres to enterprise identity security tests. policies; requires strong Label: “1 – passwords, but does not 1 Value: 5 Exposed”, support more secure credentials; maintains good access control and separation of data; passes most security tests with known and tracked vulnerabilities, logs critical activity 1 Exposed: Does not – enforce any enterprise security controls; data is accessible and visible to anyone; fails most security tests or is consistently found in violation; no activity logging or monitoring.
5 Security How robust are the security controls for the application? Please consider integration with enterprise identity management databases including integration with single sign-on; enforcement of required credentials across all user and system roles; adherence to role-based access control or other regulated authorization; the use of penetration, injection, and other dynamic/static security tests. RADIO BUTTONS: Label: “5 – Optimized”, Value: 5 Label: “4 – Strong”, Value: 4 Label: “3 – Sufficient”, Value: 3 Label: “2 – Vulnerable”, Value: 2 Label: “1 – Exposed”, Value: 1 5 – Optimized: Participates in enterprise identity management; enforces all credential requirements and policies; properly implements role-based access control; passes all security tests; actively logs and monitors activity with event-based notifications 3 – Sufficient: Contains an internal identity database that adheres to enterprise identity policies; requires strong passwords, but does not support more secure credentials; maintains good access control and separation of data; passes most security tests with known and tracked vulnerabilities, logs critical activity 1 – Exposed: Does not enforce any enterprise security controls; data is accessible and visible to anyone; fails most security tests or is consistently found in violation; no activity logging or monitoring.