Deployment: Software Environment (SE)
The overall goal of the Software Environment practice is change management. Those responsible for the software environment must ensure their ability to make authorized changes and to detect unauthorized changes and activity. Managers must enforce adherence to corporate policy.
|
DEPLOYMENT: SOFTWARE ENVIRONMENT OS and platform patching, Web application firewalls, installation and configuration documentation, application monitoring, change management, code signing. |
|||
|---|---|---|---|
| Objective | Activity | Level | |
| SE1.1 | watch software | use application input monitoring | 1 |
| SE1.2 | provide a solid host/network foundation for software | ensure host/network security basics in place | |
| SE2.1 | protect IP and make exploit development harder | use code protection | 2 |
| SE2.2 | guide operations on application needs | publish installation guides created by SSDL | |
| SE2.3 | watch software | use application behavior monitoring and diagnostics | |
| SE3.1 | protect apps (or parts of apps) that are published over trust boundaries | use code signing | 3 |
SE Level 1: Ensure the application environment supports software security. The operations group ensures required host and network security controls are functioning and proactively monitors software, including application inputs.
SE1.1
Use application input monitoring. The organization monitors the input to software it runs in order to spot attacks. For Web code, a Web application firewall can do the job. The SSG could be responsible for the care and feeding of the system. Responding to attack is not part of this activity.
SE1.2
Ensure host and network security basics are in place. The organization provides a solid foundation for software by ensuring that host and network security basics are in place. It is common for operations security teams to be responsible for duties such as patching operating systems and maintaining firewalls.
SE Level 2: Use published installation guides and actively monitor software behavior. The SSG must ensure software development processes account for the need to protect code intellectual property and for the need to produce application installation and maintenance guides for the operations group. The operations group must monitor software behavior.
SE2.1
Use code protection. In order to protect intellectual property and make exploit development harder, the organization erects barriers to reverse engineering. Obfuscation techniques could be applied as part of the production build and release process.
SE2.2
Publish installation guides created by SSDL. The software development lifecycle requires the creation of an installation guide to help operators install and configure the software. If special steps are required in order to ensure a deployment is secure, the steps are outlined in the installation guide. The guide should include discussion of COTS components.
SE2.3
Use application behavior monitoring and diagnostics. The organization monitors the behavior of production software looking for misbehavior and signs of attack. This activity goes beyond host and network monitoring to look for problems that are specific to the software, such as indications of fraud.
SE Level 3: Protect client-side code. The SSG must ensure that all code leaving the organization is signed.