Use a secure software development method in order to reduce vulnerabilities in the software. This includes: a) Adequate planning, including the organisation’s needs, legal conditions, ICT security considerations and the need to train personnel. b) Analysis of user needs, including ICT security requirements. c) Design of the software according to requirements. d) Development of the software, including secure coding and testing (see 2.1.6 and 2.1.7). e) Deployment of the software. f) Secure management of the software, including i) planning for performing and distributing security updates, and ii) planning support for newer and more recent security functionality.
The organization must create procedures that by default cyber security and security requirements are considered from the start when developing and designing new systems, digital services or business processes.
This is called the principle of built-in and default security (security by design). As a result of this approach, the design documentation should clearly indicate what measures are taken to ensure cyber security.
The organization must define the means for a secure software deployment strategy. Means should be automated if possible.
The organization shall define and implement a Secure Software Development Life Cycle (SSDLC) process in software development.
The first step in the SSDLC process should be to define security requirements that ensure that security considerations become integrated into the services being developed right from the creation phase.
It is recommended that the SSDLC process include at least the following steps:
The general rules for secure development work have been drawn up and approved by the development managers. The implementation of the rules is monitored in software development in the organization and the rules are reviewed at least yearly.
The safe development policy may include e.g. the following things:
Compliance with the rules of secure development may also be required of key partners.
The definition of security-critical code for the various services is maintained. New parts of the critical code are constantly being identified and new updates are being checked particularly closely for changes to the critical code. The aim is to keep the likelihood of security vulnerabilities to a minimum.
Software updates should have a management process in place to ensure that the latest approved patches and application updates are installed on all approved software. Earlier versions of software should be retained as a precaution.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
