+V-AA-A Stream A: Architecture Validation
---+V-AA-1-A Assess application architecture
---+V-AA-2-A Verify the application architecture for security methodically
---+V-AA-3-A Verify the effectiveness of security components

V-AA-A Stream A: Architecture Validation

Architecture validation confirms the security of the software and supporting architecture by identifying application and infrastructure architecture components and verifying their provision of security objectives and requirements.

1. Översikt

V-AA-1-A Assess application architecture

Maturity level 1 objective of the practice: Review the architecture to ensure baseline mitigations are in place for typical risks.

Benefit: Understanding of high-level architecture and sensible security measures

Short description: Identify application and infrastructure architecture components and review for basic security provisioning.

Create a view of the overall architecture and examine it for the correct provision of general security mechanisms such as authentication, authorization, user and rights management, secure communication, data protection, key management and log management. Also consider the support for privacy. Do this based on project artifacts such as architecture or design documents, or interviews with business owners and technical staff. Also consider the infrastructure components - these are all the systems, components and libraries (including SDKs) that are not specific to the application, but provide direct support to use or manage the application(s) in the organization.

Note any security-related functionality in the architecture and review its correct provision. Do this in an ad hoc manner, from the point of view of anonymous users, authorized users, and specific application roles.

Notes

Elements required for risk

  • set of questions to evaluate
  • risk levels to represent application risk
  • risk portfolio
V-AA-2-A Verify the application architecture for security methodically

Maturity level 2 objective of the practice: Review the complete provision of security mechanisms in the architecture.

Benefit: Consistent architecture review process across your organization

Short description: Validate the architecture security mechanisms.

Verify that the solution architecture addresses all identified security and compliance requirements. For each interface in the application, iterate through the list of security and compliance requirements and analyze the architecture for their provision. Also perform an interaction or data flow analysis to ensure that the requirements are adequately addressed over different components. Elaborate the analysis to show the design-level features that address each requirement.

Perform this type of analysis on both internal interfaces, e.g. between tiers, as well as external ones, e.g. those comprising the attack surface. Also identify and validate important design decisions made as part of the architecture, in particular when they deviate from the available shared security solutions in the organization. Finally, update the findings based on changes made during the development cycle, and note any requirements that are not clearly provided at the design level as assessment findings.
V-AA-3-A Verify the effectiveness of security components

Maturity level 3 objective of the practice: Review the architecture effectiveness and feedback results to improve the security of the architecture.

Benefit: Assurance of effectiveness of architecture controls

Short description: Review of the architecture components' effectiveness.

Review the effectiveness of the architecture components and their provided security mechanisms in terms of alignment with the overall strategy of the organization, and scrutinize the degree of availability, scalability and enterprise-readiness of the chosen security solutions. While tactical choices for a particular application can make sense in specific contexts, it is important to keep an eye on the bigger picture and ensure future readiness of the designed solution.

Feed any findings back into defect management to trigger further improvements to the architecture.

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav

3. Relaterade regleringar

Regleringar
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.