12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
Maintain the software code developed/used by the organisation. a) Sustain a development process which includes methodical security assessments of the code. b) Be especially aware of code with particular security significance e.g. code for i) access control, ii) traffic encryption, iii) logging, iv) parsing user input, v) buffer overflow etc. c) When using open-source code and commercial tool kits, the organisation should regularly check for new versions (ideally automatically). d) Security checks of the organisation’s own code should also be automated where appropriate when using DevOps/DevSecOps. Particularly security-relevant code (cf. previous item) should be quality-assured.
Organisations should regularly check for new versions of used open-source code. Ideally, this process is automated. New versions of open-source code can often contain new security functions, security patches, etc.
The general rules for secure development work have been drawn up and approved by the development managers. The implementation of the rules is monitored in software development in the organization and the rules are reviewed at least yearly.
The safe development policy may include e.g. the following things:
Compliance with the rules of secure development may also be required of key partners.
The organization must define the means for a secure software deployment strategy. Means should be automated if possible.
The organization has to make sure that all licensed software are updated with in 14 days of the update coming live when:
The definition of security-critical code for the various services is maintained. New parts of the critical code are constantly being identified and new updates are being checked particularly closely for changes to the critical code. The aim is to keep the likelihood of security vulnerabilities to a minimum.
.png)
