+Governance
---+G-SM Strategy and Metrics
------+G-SM-A Stream A: Create and Promote
---------+G-SM-1-A Identify the organization's risk appetite
---------+G-SM-2-A Define the security strategy
---------+G-SM-3-A Align security and business strategies
------+G-SM-B Stream B: Measure and Improve
---------+G-SM-1-B Define basic security metrics
---------+G-SM-2-B Set strategic KPIs
---------+G-SM-3-B Drive the security program through metrics
---+G-PC Policy and Compliance
------+G-PC-A Stream A: Policy and Standards
---------+G-PC-1-A Define policies and standards
---------+G-PC-2-A Develop test procedures
---------+G-PC-3-A Measure compliance to policies and standards
------+G-PC-B Stream B: Compliance Management
---------+G-PC-1-B Identify compliance requirements
---------+G-PC-2-B Standardize policy and compliance requirements
---------+G-PC-3-B Measure compliance to external requirements
---+G-EG Education and Guidance
------+G-EG-A Stream A: Training and Awareness
---------+G-EG-1-A Train all stakeholders for awareness
---------+G-EG-2-A Customize security training
---------+G-EG-3-A Standardize security guidance
------+G-EG-B Stream B: Organization and Culture
---------+G-EG-1-B Identify security champions
---------+G-EG-2-B Implement centers of excellence
---------+G-EG-3-B Establish a security community

Governance

Governance focuses on the processes and activities related to how an organization manages overall software development activities. More specifically, this includes concerns that impact cross-functional groups involved in development, as well as business processes established at the organization level.

1. Apžvalga

G-SM Strategy and Metrics

Short description: This practice forms the basis of your secure software activities by building an overall plan.

Software assurance entails many different activities and concerns. Without an overall plan, you might be spending a lot of effort to build in security, while in fact your efforts may be unaligned, disproportional or even counterproductive. The goal of the Strategy and Metrics (SM) practice is to build an efficient and effective plan for realizing your software security objectives within your organization.

A software security program that selects and prioritizes activities of the rest of the model serves as the foundation for your efforts. The practice works on building the plan, maintaining and disseminating it.

At the same time, you want to keep track of your security posture and program improvements. A metrics-driven approach is included to ensure an accurate view on your activities. To measure is to know.
G-PC Policy and Compliance

Short description: This practice drives the adherence to internal and external standards and regulations.

The Policy and Compliance (PC) practice focuses on understanding and meeting external legal and regulatory requirements while driving internal security standards to ensure compliance in a way that is aligned with the business purpose of the organization.

A driving theme for improvement within this practice is describing the organization's standards and 3rd party obligations as application requirements, enabling efficient and automated audits that may be leveraged within the SDLC and continuously demonstrate that all expectations are met.

In a sophisticated form, provision of this practice entails an organization-wide understanding of both internal standards and external compliance drivers while also maintaining low-latency checkpoints with project teams to ensure no project is operating outside expectations without visibility.
G-EG Education and Guidance

Short description: This practice focuses on increasing the knowledge in the organization regarding secure software.

The Education and Guidance (EG) practice focuses on arming personnel involved in the software lifecycle with knowledge and resources to design, develop, and deploy secure software. With improved access to information, project teams can proactively identify and mitigate the specific security risks that apply to their organization.

One major theme for improvement across the Objectives is providing training for employees and increasing their security awareness, either through instructor-led sessions or computer-based modules. As an organization progresses, it builds a broad base of training starting with developers and moving to other roles, culminating with the addition of role-based training to ensure applicability and effectiveness.

In addition to training, this practice also requires the organization to make a significant investment in improving organizational culture to promote application security through collaboration between teams. Collaboration tools and increased transparency between technologies and tools support this approach to improve the security of the applications.

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.