+SA-11(09) Interactive Application Security Testing

SA-11(09) Interactive Application Security Testing

Control

Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results.

Discussion

Interactive (also known as instrumentation-based) application security testing is a method of detecting vulnerabilities by observing applications as they run during testing. The use of instrumentation relies on direct measurements of the actual running applications and uses access to the code, user interaction, libraries, frameworks, backend connections, and configurations to directly measure control effectiveness. When combined with analysis techniques, interactive application security testing can identify a broad range of potential vulnerabilities and confirm control effectiveness. Instrumentation-based testing works in real time and can be used continuously throughout the system development life cycle.

Assessment Objective

  1. the developer of the system, system component, or system service is required to employ interactive application security testing tools to identify flaws;
  2. the developer of the system, system component, or system service is required to document the results of flaw identification.

Assessment Method

Examine

System and services acquisition policy procedures addressing system developer security testing procedures addressing interactive application security testing solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service system developer security test and evaluation plans security test and evaluation results security flaw and remediation tracking reports system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with developer security testing responsibilities organizational personnel with configuration management responsibilities system developers

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SA-11(09) Interactive Application Security Testing – Assessment Procedure