MONITASOINEN SUOJAAMINEN KOKO ELINKAAREN AJAN – OHJELMISTOJEN SUOJAAMINEN VERKKOHYÖKKÄYKSILTÄ

The security of the data processing environment is tested. Testing takes into account the appropriate level of security and the level of implementation, integration and configuration. Security must be taken care of throughout the entire life cycle of the environment.

At least the following should be considered here:

• The purposes of use of the software (applications, services, systems) and the roles that may implement the security of the software have been identified.
• The security needs of the software (applications, services, systems) have been assessed, taking into account in particular the intended use of the software and its possible role in implementing security, the attack surface area, and the nature and security class of the data being processed.
• The software (applications, services, systems) dependencies and interfaces have been identified. Dependencies and interfaces have been assigned the same requirements as software, taking into account, for example, the used libraries, interfaces (APIs) and hardware bindings. The requirements take into account both the server-side and the client-side parts.
• Critical software (applications, services, systems) is implemented or the implementation is checked as far as possible against a reliable standard and/or using safe programming guidelines.
• It has been ensured that the software (applications, services, systems) program code quality maintenance, development and change management meet the needs throughout the entire life cycle.
• It has been ensured that the software (applications, services, systems) meet the requirements derived from legislation.