The system and application development life cycle shall include security considerations.
Guidance
- System and application development life cycle should include the acquisition process of the
organization's business critical systems and its components.
- Vulnerability awareness and prevention training for (web application) developers, and advanced
social engineering awareness training for high-profile roles should be considered.
- When hosting internet facing applications the implementation of a web application firewall (WAF)
should be considered.
The development process for critical systems and system components shall cover the full
design cycle and shall provide a description of the functional properties of security controls,
and design and implementation information for security-relevant system interfaces.
Guidance
The development cycle includes:
- All development phases: specification , design, development, implementation.
- Configuration management for planned and unplanned changes and change control during the
development.
- Flaw tracking & resolution.
- Security testing.
The development unit itself maintains a list of criteria that need to be met before a task can be marked as completed. The criteria may include e.g. review requirements, documentation requirements and testing requirements.
New code will only be implemented after extensive testing that meets pre-defined criteria. Tests should cover usability, security, effects on other systems, and user-friendliness.
The organization shall define and implement a Secure Software Development Life Cycle (SSDLC) process in software development.
The first step in the SSDLC process should be to define security requirements that ensure that security considerations become integrated into the services being developed right from the creation phase.
It is recommended that the SSDLC process include at least the following steps:
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
