+D-SA-B Stream B: Technology Management
---+D-SA-1-B Identify tools and technologies
---+D-SA-2-B Promote preferred tools and technologies
---+D-SA-3-B Enforce the use of recommended technologies

D-SA-B Stream B: Technology Management

Technologies and frameworks are the cornerstones of any software solution. The security properties of these must be looked into to ensure an appropriate security level and to anticipate any potential issues herein.

1. Преглед

D-SA-1-B Identify tools and technologies

Maturity level 1 objective of the practice: Insert consideration of proactive security guidance into the software design process.

Benefit: Transparency of technologies that introduce security risk

Short description: Elicit technologies, frameworks and integrations within the overall solution to identify risk.

People often take the path of least resistance in developing, deploying or operating a software solution. New technologies are often included when they can facilitate or speed up the effort or enable the solution to scale better. These new technologies might, however, introduce new risks to the organization that you need to manage.

Identify the most important technologies, frameworks, tools and integrations being used for each application. Use the knowledge of the architect to study the development and operating environment as well as artifacts. Then evaluate them for their security quality and raise important findings to be managed.
D-SA-2-B Promote preferred tools and technologies

Maturity level 2 objective of the practice: Direct the software design process toward known secure services and secure-by-default designs.

Benefit: Technologies with appropriate security level available to product teams

Short description: Standardize technologies and frameworks to be used throughout the different applications.

Identify commonly used technologies, frameworks, and tools in use across software projects in the organization, focusing on capturing the high-level technologies.

Create a list and share it across the development organization as recommended technologies. When selecting them, consider incident history, track record for responding to vulnerabilities, appropriateness of functionality for the organization, excessive complexity in usage of the third-party component, and sufficient knowledge within the organization.

Senior developers and architects create this list, including input from managers and security auditors. Share this list of recommended components with the development organization. Ultimately, the goal is to provide well-known defaults for project teams. Perform a periodic review of these technologies for security and appropriateness.
D-SA-3-B Enforce the use of recommended technologies

Maturity level 3 objective of the practice: Formally control the software design process and validate utilization of secure components.

Benefit: Limited attack surface due to usage of vetted technologies

Short description: Impose the use of standard technologies on all software development.

For all proprietary development (in-house or acquired), impose and monitor the use of standardized technology. Depending on your organization, either implement these restrictions into build or deployment tools, by means of after-the-fact automated analysis of application artifacts (e.g., source code, configuration files or deployment artifacts), or periodically review focusing on the correct use of these frameworks.

Verify several factors with project teams. Identify use of non-recommended technologies to determine if there are gaps in recommendations versus the organization's needs. Examine unused or incorrectly used design patterns and reference platform modules to determine if updates are needed. Additionally, implement functionality in the reference platforms as the organization evolves and project teams request it.

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

Изисквания

3. Свързани регулации

Регулации
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.