Skip to content

SXMag

Blog about Software development

  • Home
  • software development
  • Development and approval of the development manual secure software

Development and approval of the development manual secure software

Posted on July 28, 2022December 28, 2022 By Victor Fasano
software development

Should be prepared and agreed with senior management organization the following documents:

– information security policy (4.13 GOST R 56939–2016);

– guidance on the development of secure software, meeting the requirements of 4.10 GOST R 56939–2016 and harmonized with the information security policy and other governing documents of the organization.

You can create multiple development guides secure software with different scope (different software and/or software development teams). After consultation with the top management of the organization, these documents are required:

– communicate to all employees of the organization, involved in the process of developing secure software;

– make it mandatory;

– make available for review and use employees;

– keep up to date.

Create and implement a process implementation plan secure software development

Planning for the implementation of development measures secure software is carried out on the basis of information, set out in the Secure Software Development Guide. At development processes within the scope measures to develop secure software, the developer needs to develop an implementation plan. It is allowed that this plan implied the phased introduction of appropriate measures from security software development baseline (Section 5 GOST R 56939–2016) or the use of compensatory measures in in accordance with 4.5 GOST R 56939–2016. Choice of development measures secure software to be implemented in the organization, and assignment of the selected measures to a particular stage of implementation performed taking into account:

– goals for implementing measures to develop secure software;

– goals and features of the organization of internal processes software developer;

– results of information security threat analysis, relevant to the software development environment;

– the level of readiness of these processes.

Analysis of threats relevant to the software development environment information security and documentation of results analysis is performed in accordance with GOST R 58412. At the same time, the choice of measures and related justification, including why certain other measures are not to be implemented, should be documented.

For each implemented measure to develop secure software in The implementation plan should reflect

– a list of tasks to be performed to implement the measure;

– list and amount of resources required for implementationmeasures;

– expected results and deadlines for completing the task;

– employees responsible for the performance of the task.

It is allowed to draw up separate plans for a specific software and/or development teams. Implementation Guide for development of secure software, including a description of tasks, performed for implementation, and the distribution of roles and obligations related to the implementation of measures between employees, are presented in section 5. In section 5 for typical actions, performed during the implementation and implementation of measures to develop secure software, the recommended distribution is presented roles and responsibilities.

In the implementation of measures to develop secure software, employees of the software developer are involved or third party organization with the necessary competencies to solve certain problems. Annex A provides information about the roles of software developer employees, related to the implementation of measures to develop secure software.

Documented implementation plan for development measures secure software must be agreed with all stakeholders and submit for approval top management of the organization for their final decision decisions on the implementation of measures to develop secure software and allocation of necessary resources.

With the implementation plan follows familiarize all employees involved in the software development process, including for the purpose of informing them about the goals of the organization in areas of secure software development, as well as the tasks set and deadlines for their implementation.

N o t e – Agree on a plan for the implementation of development measures secure software is necessary at least with the head of software development and the head of the secure software development group (if available in organizations).

Should be prepared and agreed with senior management organizing procedures and guidelines that are consistent with requirements of GOST R 56939 and other applicable standards industries, contribute to the implementation of the development process secure software and take into account the peculiarities of the organization of internal processes, culture and values of the software developer.

After consultation with the top management of the organization, these documents are required:

– communicate to all employees of the organization, involved in the process of developing secure software;

– make it mandatory;

– make available for review and use employees;

– keep up to date.

Documents related to the implementation of development measures secure software should be developed taking into account the requirements for software developer documentation submitted for each measure on the development of secure software in section 5 of GOST R 56939-2016, and provisions of 4.12 GOST R 56939-2016. Documents recommended be placed on a common resource accessible to all stakeholders associated with software development projects.

Documents containing detailed information relating to specific project, it is recommended to place on the resource, available to all participants of the software development project. Wherein it is necessary to provide differentiation of access to information limited access on the principle of necessary knowledge and elimination of conflicts of interest by separating roles and areas of responsibility, access to information about vulnerabilities programs should be restricted.

During the implementation of measures, periodic verification of measures for the development of secure software implemented in accordance with the implementation plan. Purpose of Periodic Reviews is to track changes and determine whether whether the implementation plan for the development of secure software is being implemented properly. The frequency of inspections, as well as their order and the conditions for carrying out are indicated in the plan for the implementation of measures. The implementation plan for the development of secure software should be keep up to date and correct the results of internal audits. Identified during the development or operation of software program vulnerabilities are described in accordance with GOST R 56545. If identified during the development or operation of the software program vulnerability also exists in the software (for example, in previous version) that is already in use by users

Tags: .net software development company agile principles can be only used for software development ai software development cost of software development customized software development companies development cycle software freelance software development kanban software development mobile software development project management in software development sandbox software development software development software development companies usa software development consultant software development costs software development manager salary software development methods software development outsourcing company software development process models software development vs web development

Post navigation

❮ Previous Post: Software engineering
Next Post: Methods for identifying software requirements ❯

You may also like

software development
software life cycle securities
September 20, 2022
software development
The role of standardization and certification in PS quality management
May 20, 2022
software development
Software engineering
June 4, 2022
software development
Trends in enterprise software development
September 2, 2022

Recent Posts

  • Incremental model of software development
  • Software Development Methodologies
  • Microsoft Solutions Framework (MSF)
  • Next level software development
  • software life cycle securities

Archives

  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • March 2022
  • January 2022

Categories

  • software development

Tools and Services

Linx

AWS Cloud9

Zend

Atom

SumatoSoft

CodeLobster

Copyright © 2023 SXMag.

Theme: Oceanly News Dark by ScriptsTown