+SA-11(06) Attack Surface Reviews
|
SA-11(06) Attack Surface Reviews
Control
Require the developer of the system, system component, or system service to perform attack surface reviews.
Discussion
Attack surfaces of systems and system components are exposed areas that make those systems more vulnerable to attacks. Attack surfaces include any accessible areas where weaknesses or deficiencies in the hardware, software, and firmware components provide opportunities for adversaries to exploit vulnerabilities. Attack surface reviews ensure that developers analyze the design and implementation changes to systems and mitigate attack vectors generated as a result of the changes. The correction of identified flaws includes deprecation of unsafe functions.
Assessment Objective
the developer of the system, system component, or system service is required to perform attack surface reviews.
Assessment Method
Examine
System and services acquisition policy
procedures addressing system developer security testing
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system developer security testing and evaluation plans
system developer security testing and evaluation results
records of attack surface reviews
system security plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with developer security testing responsibilities
organizational personnel with configuration management responsibilities
system developers
1. Pregled
1.1 Sklici
1.2 Ugotovljene zahteve
1.3 Povezani predpisi
2. Ugotovljene zahteve
3. Povezani predpisi
Povezane zadeve
|