Secure software development practices

The development unit itself maintains a list of criteria that need to be met before a task can be marked as completed. The criteria may include e.g. review requirements, documentation requirements and testing requirements.

New code will only be implemented after extensive testing that meets pre-defined criteria. Tests should cover usability, security, effects on other systems, and user-friendliness.

Organisation should:

• Identify and list the types of software to be managed, including firmware, operating systems, applications, libraries, and device drivers.
• Ensure that repositories for managed software are created and maintained.
• Implement security measures to protect the software repositories from unauthorized access and manipulation.
• Conduct regular reviews to ensure that all software in use remains approved and meets the organization’s security and operational standards.
• Keep an updated record of all software versions and their respective patch levels to ensure that all software is up-to-date and secure.

The organization shall define and implement a Secure Software Development Life Cycle (SSDLC) process in software development.

The first step in the SSDLC process should be to define security requirements that ensure that security considerations become integrated into the services being developed right from the creation phase.

It is recommended that the SSDLC process include at least the following steps:

• A - Training
• B - Description of the requirements
• C - Design
• D - Development
• E - Security testing
• F - Publication
• G - Responding to issues