In the platform risks section, the discussion focused mainly on operating systems and other software making up the software stack on top of which the organization’s custom applications run. If the organization develops or purchases custom software, it is important that the software is developed with security in mind from the get-go to help ensure that it does not contain any software security weaknesses that may be exploited by adversaries to compromise the system. To accomplish this, the organization needs to makes its software development process security aware. The SDLC activities for doing so are documented in the Software “Insecure Development Life Cycle (SDLC) Risks” section under Addressing Process Risks earlier in this document. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan. ID Activity / Security Control Rationale Associated Documentation Implement security activities and gates Your organization develops software that 119 into your organization’s SDLC (please refer does not have security weaknesses. to the checklist in the Software “Insecure Development Life Cycle (SDLC) Risks” section for additional details). 120 Request independent-party software Gain confidence that the security assessments of the applications software your organization purchases does being purchased to gauge the security not have security weaknesses. posture of the software being purchased. The table below outlines the activities and controls that are currently missing from the application security plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
In the platform risks section, the discussion focused mainly on operating systems and other software making up the software stack on top of which the organization’s custom applications run. If the organization develops or purchases custom software, it is important that the software is developed with security in mind from the get-go to help ensure that it does not contain any software security weaknesses that may be exploited by adversaries to compromise the system. To accomplish this, the organization needs to makes its software development process security aware. The SDLC activities for doing so are documented in the “Insecure Software Development Life Cycle (SDLC) Risks” section under Addressing Process Risks earlier in this document. The following checklist summarizes the various security best practices and controls that an organization should consider implementing. For more details on any of the activities / security controls, please refer to the descriptions in the Guide to Developing a Cyber Security and Risk Mitigation Plan. ID Activity / Security Control Rationale Associated Documentation 119 Implement security activities and gates into your organization’s SDLC (please refer to the checklist in the “Insecure Software Development Life Cycle (SDLC) Risks” section for additional details). Your organization develops software that does not have security weaknesses. 120 Request independent-party software security assessments of the applications being purchased to gauge the security posture of the software being purchased. Gain confidence that the software your organization purchases does not have security weaknesses. The table below outlines the activities and controls that are currently missing from the application security plan of the organization. Each activity row includes columns that describe the plan to implement the activity, the schedule for implementation, and the party responsible for its implementation and maintenance.
2014-Coop-Cyber-Security-Plan-Template-Update-1.docx