Соответствие требованиям

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

CIS Critical Security Controls v7.1 (SANS Top 20)

Framework

CSC 18

Для проведения оценки соответствия по документу войдите в систему.

Список требований

CSC 18 Application Software Security
Manage the security life cycle of all in-house developed and acquired software in order to prevent, detect, and correct security weaknesses.
CSC 18.1 Establish Secure Coding Practices
Establish secure coding practices appropriate to the programming language and development environment being used.
Обязательно для implementation Group 2 3
CSC 18.2 Ensure That Explicit Error Checking is Performed for All In-House Developed Software
For in-house developed software, ensure that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats.
Обязательно для implementation Group 2 3
CSC 18.3 Verify That Acquired Software is Still Supported
Verify that the version of all software acquired from outside your organization is still supported by the developer or appropriately hardened based on developer security recommendations.
Обязательно для implementation Group 2 3
CSC 18.4 Only Use Up-to-Date and Trusted Third-Party Components
Only use up-to-date and trusted third-party components for the software developed by the organization.
Обязательно для implementation Group 3
CSC 18.5 Use Only Standardized and Extensively Reviewed Encryption Algorithms
Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
Обязательно для implementation Group 2 3
CSC 18.6 Ensure Software Development Personnel are Trained in Secure Coding
Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities.
Обязательно для implementation Group 2 3
CSC 18.7 Apply Static and Dynamic Code Analysis Tools
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to for internally developed software.
Обязательно для implementation Group 2 3
CSC 18.8 Establish a Process to Accept and Address Reports of Software Vulnerabilities
Establish a process to accept and address reports of software vulnerabilities, including providing a means for external entities to contact your security group.
Обязательно для implementation Group 2 3
CSC 18.9 Separate Production and Non-Production Systems
Maintain separate environments for production and non-production systems. Developers should not have unmonitored access to production environments.
Обязательно для implementation Group 2 3
CSC 18.10 Deploy Web Application Firewalls
Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks. For applications that are not web-based, specific application firewalls should be deployed if such tools are available for the given application type. If the traffic is encrypted, the device should either sit behind the encryption or be capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web application firewall should be deployed.
Обязательно для implementation Group 2 3
CSC 18.11 Use Standard Hardening Configuration Templates for Databases
For applications that rely on a database, use standard hardening configuration templates. All systems that are part of critical business processes should also be tested.
Обязательно для implementation Group 2 3

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.