+SA-17(09) Design Diversity

SA-17(09) Design Diversity

Control

Use different designs for [Assignement: critical systems] to satisfy a common set of requirements or to provide equivalent functionality.

Discussion

Design diversity is achieved by supplying the same requirements specification to multiple developers, each of whom is responsible for developing a variant of the system or system component that meets the requirements. Variants can be in software design, in hardware design, or in both hardware and a software design. Differences in the designs of the variants can result from developer experience (e.g., prior use of a design pattern), design style (e.g., when decomposing a required function into smaller tasks, determining what constitutes a separate task and how far to decompose tasks into sub-tasks), selection of libraries to incorporate into the variant, and the development environment (e.g., different design tools make some design patterns easier to visualize). Hardware design diversity includes making different decisions about what information to keep in analog form and what information to convert to digital form, transmitting the same information at different times, and introducing delays in sampling (temporal diversity). Design diversity is commonly used to support fault tolerance.

Assessment Objective

different designs are used for [Assignement: critical systems] to satisfy a common set of requirements or to provide equivalent functionality.

Assessment Method

Examine

System and services acquisition policy enterprise architecture policy procedures addressing developer security architecture and design diversity for the system solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service system design documentation system security architecture documentation system configuration settings and associated documentation developer documentation describing design diversity system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system developer organizational personnel with information security architecture responsibilities

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări

Tichete legate

Legături
is blocked by SA-17(09) Design Diversity – Assessment Procedure