6.2.2 For the purpose of point 6.2.1., the relevant entities shall: (a) carry out an analysis of security …

Requirement

For the purpose of point 6.2.1., the relevant entities shall: (a) carry out an analysis of security requirements at the specification and design phases of any development or acquisition project undertaken by the relevant entities or on behalf of those entities; (b) apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures; (c) lay down security requirements regarding development environments;

(d) establish and implement security testing processes in the development life cycle; (e) appropriately select, protect and manage security test data; (f) sanitise and anonymise testing data according to the risk assessment carried out pursuant to point 2.1.

Guidance

• A secure software development life cycle (S SDLC) process should be implemented by all entities. However, smaller entities can use a less demanding process such as implementing secure-by-design practices and security-testing processes.
• Depending on the type of requirement, the rules for the secure development of software and systems should include appropriate software testing methods (e.g. black-box, ad-hoc testing, static versus dynamic application security testing).
• Test security by design at various stages of the secure development of the SSDLC prior to go-live, utilising independent tools and a self-service testing platform throughout the SSDLC.
• When real production data - or derived variations of it - is used for testing, ensure that such data is properly sanitised or anonymised. An indicative, non-exhaustive list of techniques:
  • masking or pseudonymization on fields like names, emails, IDs;
  • deletion or redaction of identifiers (e.g. personal IDs, birth dates, ZIP codes); and
  • non-irreversible or one-way anonymisation.
• When using Free and Open Source Software components, entities should take into account the voluntary nature of open source projects (see guidance of section 5.1). Where possible, entities should assist the open source projects that they depend on in adopting secure systems and secure coding principles (such as introducing SSDLC processes suited to the project’s way of working).

Examples of evidence

• Evidence that secure development rules have been adopted (indicative, non-exhaustive list):
  • documentation for each phase of the life cycle,
  • process and workflow diagrams,
  • audit and testing reports,
  • version control,
  • change management logs,
  • code reviews, and
  • project management tools.
• Evidence of the test results from secure development environments, including that measures for protecting test data are maintained.
• Evidence of the software-testing methods chosen for a particular test scenario and an explanation of the choice.
• Test results of each phase of the SSDLC maintained and up to date.
• Test results maintained and, where appropriate, approved by management bodies.
• Evidence that a software-testing method is chosen at each stage of the software development life cycle.

1. Prehľad

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

3. Súvisiace predpisy

Prepojené úlohy

• ENISA -