+PW.6 Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security
---+PW.6.1 Use compiler, interpreter, and build tools that offer features to improve executable security.
---+PW.6.2 Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved …
|
PW.6 Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security
StatementDecrease the number of security vulnerabilities in the software and reduce costs by eliminating vulnerabilities before testing occurs.
1. Prezentare generală
| Titlu |
Standard |
|
PW.6.1 Use compiler, interpreter, and build tools that offer features to improve executable security.
|
StatementUse compiler, interpreter, and build tools that offer features to improve executable security. Example 1:Use up-to-date versions of compiler, interpreter, and build tools. Example 2:Follow change management processes when deploying or updating compiler, interpreter, and build tools, and audit all unexpected changes to tools. Example 3:Regularly validate the authenticity and integrity of compiler, interpreter, and build tools. See PO.3.
|
|
PW.6.2 Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved …
|
StatementDetermine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved configurations. Example 1:Enable compiler features that produce warnings for poorly secured code during the compilation process. Example 2:Implement the “clean build” concept, where all compiler warnings are treated as errors and eliminated except those determined to be false positives or irrelevant. Example 3:Perform all builds in a dedicated, highly controlled build environment. Example 4:Enable compiler features that randomize or obfuscate execution characteristics, such as memory location usage, that would otherwise be predictable and thus potentially exploitable. Example 5:Test to ensure that the features are working as expected and are not inadvertently causing any operational issues or other problems. Example 6:Continuously verify that the approved configurations are being used. Example 7:Make the approved tool configurations available as configuration-as-code so developers can readily use them.
|
1.1 Referințe
1.2 Cerințe identificate
1.3 Reglementări asociate
2. Cerințe identificate
3. Reglementări asociate
Reglementări
| Sursă |
Reglementare |
Tichete legate
- NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.
DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.
|