+SA-15(08) Reuse of Threat and Vulnerability Information
|
SA-15(08) Reuse of Threat and Vulnerability Information
Control
Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.
Discussion
Analysis of vulnerabilities found in similar software applications can inform potential design and implementation issues for systems under development. Similar systems or system components may exist within developer organizations. Vulnerability information is available from a variety of public and private sector sources, including the NIST National Vulnerability Database.
Assessment Objective
- the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process;
- the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.
Assessment Method
Examine
System and services acquisition policy
supply chain risk management plan
procedures addressing development process, standards, and tools
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
threat modeling and vulnerability analyses from similar systems, system components, or system services
system security plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
system developer
organizational personnel with supply chain risk management responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|