+PW Produce Well-Secured Software
---+PW.1 Design Software to Meet Security Requirements and Mitigate Security Risks
------+PW.1.1 Use forms of risk modeling – such as threat modeling, attack modeling, or attack surface mapping – to help assess the security risk for the software.
------+PW.1.2 Track and maintain the software’s security requirements, risks, and design decisions.
------+PW.1.3 Where appropriate, build in support for using standardized security features and services (e.g., enabling software to integrate with existing log …
---+PW.2 Review the Software Design to Verify Compliance with Security Requirements and Risk Information
------+PW.2.1 Have 1) a qualified person (or people) who were not involved with the design and/or 2) automated processes instantiated in the toolchain review the …
---+PW.4 Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality
------+PW.4.1 Acquire and maintain well-secured software components (e.g., software libraries, modules, middleware, frameworks) from commercial, open-source, and …
------+PW.4.2 Create and maintain well-secured software components in-house following SDLC processes to meet common internal software development needs that cannot …
------+PW.4.4 Verify that acquired commercial, open-source, and all other third-party software components comply with the requirements, as defined by the …
---+PW.5 Create Source Code by Adhering to Secure Coding Practices
------+PW.5.1 Follow all secure coding practices that are appropriate to the development languages and environment to meet the organization’s requirements.
---+PW.6 Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security
------+PW.6.1 Use compiler, interpreter, and build tools that offer features to improve executable security.
------+PW.6.2 Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved …
---+PW.7 Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements
------+PW.7.1 Determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, …
------+PW.7.2 Perform the code review and/or code analysis based on the organization’s secure coding standards, and record and triage all discovered issues and …
---+PW.8 Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements
------+PW.8.1 Determine whether executable code testing should be performed to find vulnerabilities not identified by previous reviews, analysis, or testing and, …
------+PW.8.2 Scope the testing, design the tests, perform the testing, and document the results, including recording and triaging all discovered issues and …
---+PW.9 Configure Software to Have Secure Settings by Default
------+PW.9.1 Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the …
------+PW.9.2 Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.

PW Produce Well-Secured Software

Produce Well-Secured Software

Organizations should produce well-secured software with minimal security vulnerabilities in its releases.

1. Panoramica

PW.1 Design Software to Meet Security Requirements and Mitigate Security Risks

Statement

Identify and evaluate the security requirements for the software; determine what security risks the software is likely to face during operation and how the software’s design and architecture should mitigate those risks; and justify any cases where risk-based analysis indicates that security requirements should be relaxed or waived. Addressing security requirements and risks during software design (secure by design) is key for improving software security and also helps improve development efficiency.
PW.2 Review the Software Design to Verify Compliance with Security Requirements and Risk Information

Statement

Help ensure that the software will meet the security requirements and satisfactorily address the identified risk information.
PW.4 Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality

Statement

Lower the costs of software development, expedite software development, and decrease the likelihood of introducing additional security vulnerabilities into the software by reusing software modules and services that have already had their security posture checked. This is particularly important for software that implements security functionality, such as cryptographic modules and protocols.
PW.5 Create Source Code by Adhering to Secure Coding Practices

Statement

Decrease the number of security vulnerabilities in the software, and reduce costs by minimizing vulnerabilities introduced during source code creation that meet or exceed organization-defined vulnerability severity criteria.
PW.6 Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security

Statement

Decrease the number of security vulnerabilities in the software and reduce costs by eliminating vulnerabilities before testing occurs.
PW.7 Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements

Statement

Help identify vulnerabilities so that they can be corrected before the software is released to prevent exploitation. Using automated methods lowers the effort and resources needed to detect vulnerabilities. Human-readable code includes source code, scripts, and any other form of code that an organization deems human-readable.
PW.8 Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements

Statement

Help identify vulnerabilities so that they can be corrected before the software is released in order to prevent exploitation. Using automated methods lowers the effort and resources needed to detect vulnerabilities and improves traceability and repeatability. Executable code includes binaries, directly executed bytecode and source code, and any other form of code that an organization deems executable.
PW.9 Configure Software to Have Secure Settings by Default

Statement

Help improve the security of the software at the time of installation to reduce the likelihood of the software being deployed with weak security settings, putting it at greater risk of compromise.

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni