+Electronic (OSCAL) Version of Secure Software Development Framework (SSDF): Recommendations for Mitigating the Risk of Software Vulnerabilities
---+PO Prepare the Organization
------+PO.1 Define Security Requirements for Software Development
---------+PO.1.1 Identify and document all security requirements for the organization’s software development infrastructures and processes, and maintain the …
---------+PO.1.2 Identify and document all security requirements for organization-developed software to meet, and maintain the requirements over time.
---------+PO.1.3 Communicate requirements to all third parties who will provide commercial software components to the organization for reuse by the organization’s own …
------+PO.2 Implement Roles and Responsibilities
---------+PO.2.1 Create new roles and alter responsibilities for existing roles as needed to encompass all parts of the SDLC. Periodically review and maintain the …
---------+PO.2.2 Provide role-based training for all personnel with responsibilities that contribute to secure development. Periodically review personnel proficiency …
---------+PO.2.3 Obtain upper management or authorizing official commitment to secure development, and convey that commitment to all with development-related roles …
------+PO.3 Implement Supporting Toolchains
---------+PO.3.1 Specify which tools or tool types must or should be included in each toolchain to mitigate identified risks, as well as how the toolchain components …
---------+PO.3.2 Follow recommended security practices to deploy, operate, and maintain tools and toolchains.
---------+PO.3.3 Configure tools to generate artifacts of their support of secure software development practices as defined by the organization.
------+PO.4 Define and Use Criteria for Software Security Checks
---------+PO.4.1 Define criteria for software security checks and track throughout the SDLC.
---------+PO.4.2 Implement processes, mechanisms, etc. to gather and safeguard the necessary information in support of the criteria.
------+PO.5 Implement and Maintain Secure Environments for Software Development
---------+PO.5.1 Separate and protect each environment involved in software development.
---------+PO.5.2 Secure and harden development endpoints (i.e., endpoints for software designers, developers, testers, builders, etc.) to perform development-related …
---+PS Protect Software
------+PS.1 Protect All Forms of Code from Unauthorized Access and Tampering
---------+PS.1.1 Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only …
------+PS.2 Provide a Mechanism for Verifying Software Release Integrity
---------+PS.2.1 Make software integrity verification information available to software acquirers.
------+PS.3 Archive and Protect Each Software Release
---------+PS.3.1 Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software …
---------+PS.3.2 Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials .SBOM).
---+PW Produce Well-Secured Software
------+PW.1 Design Software to Meet Security Requirements and Mitigate Security Risks
---------+PW.1.1 Use forms of risk modeling – such as threat modeling, attack modeling, or attack surface mapping – to help assess the security risk for the software.
---------+PW.1.2 Track and maintain the software’s security requirements, risks, and design decisions.
---------+PW.1.3 Where appropriate, build in support for using standardized security features and services (e.g., enabling software to integrate with existing log …
------+PW.2 Review the Software Design to Verify Compliance with Security Requirements and Risk Information
---------+PW.2.1 Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the …
------+PW.4 Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality
---------+PW.4.1 Acquire and maintain well-secured software components (e.g., software libraries, modules, middleware, frameworks) from commercial, open-source, and …
---------+PW.4.2 Create and maintain well-secured software components in-house following SDLC processes to meet common internal software development needs that cannot …
---------+PW.4.4 Verify that acquired commercial, open-source, and all other third-party software components comply with the requirements, as defined by the …
------+PW.5 Create Source Code by Adhering to Secure Coding Practices
---------+PW.5.1 Follow all secure coding practices that are appropriate to the development languages and environment to meet the organization’s requirements.
------+PW.6 Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security
---------+PW.6.1 Use compiler, interpreter, and build tools that offer features to improve executable security.
---------+PW.6.2 Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved …
------+PW.7 Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements
---------+PW.7.1 Determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, …
---------+PW.7.2 Perform the code review and/or code analysis based on the organization’s secure coding standards, and record and triage all discovered issues and …
------+PW.8 Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements
---------+PW.8.1 Determine whether executable code testing should be performed to find vulnerabilities not identified by previous reviews, analysis, or testing and, …
---------+PW.8.2 Scope the testing, design the tests, perform the testing, and document the results, including recording and triaging all discovered issues and …
------+PW.9 Configure Software to Have Secure Settings by Default
---------+PW.9.1 Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the …
---------+PW.9.2 Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.
---+RV Respond to Vulnerabilities
------+RV.1 Identify and Confirm Vulnerabilities on an Ongoing Basis
---------+RV.1.1 Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that …
---------+RV.1.2 Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.
---------+RV.1.3 Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support …
------+RV.2 Assess, Prioritize, and Remediate Vulnerabilities
---------+RV.2.1 Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.
---------+RV.2.2 Plan and implement risk responses for vulnerabilities.
------+RV.3 Analyze Vulnerabilities to Identify Their Root Causes
---------+RV.3.1 Analyze identified vulnerabilities to determine their root causes.
---------+RV.3.2 Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.
---------+RV.3.3 Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external …
---------+RV.3.4 Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or …
|
Electronic (OSCAL) Version of Secure Software Development Framework (SSDF): Recommendations for Mitigating the Risk of Software Vulnerabilities
Electronic (OSCAL) Version of Secure Software Development Framework (SSDF): Recommendations for Mitigating the Risk of Software Vulnerabilities
1. Panoramica
| Titolo |
Standard |
|
PO Prepare the Organization
|
Prepare the Organization Organizations should ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. Many organizations will find some PO practices to also be applicable to subsets of their secure software development, like individual development groups or projects.
|
|
PS Protect Software
|
Protect Software Organizations should protect all components of the software from tampering and unauthorized access
|
|
PW Produce Well-Secured Software
|
Produce Well-Secured Software Organizations should produce well-secured software with minimal security vulnerabilities in its releases.
|
|
RV Respond to Vulnerabilities
|
Respond to Vulnerabilities Organizations should identify residual vulnerabilities in software releases and respond appropriately to address those vulnerabilities and prevent similar ones from occurring in the future
|
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|