T7 Information System Acquisition, Development & Maintenance

OBJECTIVE

To maintain an information systems acquisition, development and maintenance policy covering the security of information systems throughout its lifecycle.

PERFORMANCE INDICATOR

Extent of information systems acquisition, development and maintenance policy deployment and adoption across the entity.

AUTOMATION GUIDANCE

Not applicable

RELEVANT THREATS AND VULNERABILITIES

1. Unsuitable information systems acquisition, development and maintenance policy
2. Partial information systems acquisition, development and maintenance policy not covering the entire asset lifecycle

APPLICABLE CONTROLS

Followings are controls applicable for this control family.

• T7.1.1 - P4 - INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENENCE POLICY
• T7.7.1 - P1 - CONTROL OF TECHNICAL VULNERABILITIES

OBJECTIVE

To ensure that security requirements are established and functionally integrated into information systems

PERFORMANCE INDICATOR

Percentage of systems implementations accepted into service with all security requirements implemented

AUTOMATION GUIDANCE

Not applicable

RELEVANT THREATS AND VULNERABILITIES

1. Equipment malfunction
2. Abuse of functionality

APPLICABLE CONTROLS

Followings are controls applicable for this control family.

• T7.2.1 - P3 - SECURITY REQUIREMENTS ANALYSIS AND SPECIFICATION
• T7.2.2 - DEVELOPER-PROVIDED STRATEGY

OBJECTIVE

To prevent errors, loss, unauthorized modification or misuse of information in applications

PERFORMANCE INDICATOR

Percentage of systems for which data validation controls have been adequately defined, implemented, and proven effective by thorough testing

AUTOMATION GUIDANCE

Source code testing tools, web application security scanning tools, and object code testing tools have proven useful in securing application software, along with manual application security penetration testing by testers who have extensive programming knowledge and application penetration testing expertise. The Common Weakness Enumeration (CWE) initiative is used by many such tools to identify the weaknesses that they find. Entities can also use CWE to determine which types of weaknesses they are most interested in addressing and removing. When evaluating the effectiveness of testing for these weaknesses, MITRE’s Common Attack Pattern Enumeration and Classification can be used to organize and record the breadth of the testing for the CWEs and to enable testers to think like attackers in their development of test cases.

RELEVANT THREATS AND VULNERABILITIES

1. Software malfunction
2. Illegal processing of data
3. Injection flaws, such as SQL, OS, and LDAP
4. Broken Authentication and Session Management
5. Cross-Site Scripting (XSS)

APPLICABLE CONTROLS

Followings are controls applicable for this control family.

• T7.3.1 - P2 - INPUT DATA VALIDATION
• T7.3.2 - P2 - CONTROL OF INTERNAL PROCESSING
• T7.3.3 - P2 - MESSAGE INTEGRITY
• T7.3.4 - P2 - OUTPUT DATA VALIDATION

OBJECTIVE

To protect the confidentiality, authenticity or integrity of information by cryptographic means.

PERFORMANCE INDICATOR

Percentage of systems containing valuable/sensitive data for which suitable cryptographic controls have been fully implemented

AUTOMATION GUIDANCE

Cryptography can only be performed through the use of automated cryptographic systems. These systems should automate all processes, including key generation, distribution, revocation, restoration, etc.

RELEVANT THREATS AND VULNERABILITIES

1. Weak cryptography used for sensitive data
2. Eavesdropping / Packet sniffing Sensitive Data Exposure

APPLICABLE CONTROLS

Followings are controls applicable for this control family.

• T7.4.1 - P2 - POLICY ON THE USE OF CRYPTOGRAPHIC CONTROLS
• T7.4.2 - P2 - KEY MANAGEMENT

OBJECTIVE

To ensure the security of system files.

PERFORMANCE INDICATOR

Percentage of systems assessed as fully compliant with the information systems acquisition, development and maintenance policy

AUTOMATION GUIDANCE

Security of system files can only be achieved through the use of automated controls, including but not limited to file permission restrictions, file access log, and file hashing for integrity check.

RELEVANT THREATS AND VULNERABILITIES

1. Unauthorized access to system files
2. Corruption of data

APPLICABLE CONTROLS

Followings are controls applicable for this control family.

• T7.5.1 - P4 - CONTROL OF OPERATIONAL SOFTWARE
• T7.5.2 - P3 - PROTECTION OF SYSTEM TEST DATA
• T7.5.3 - P3 - ACCESS CONTROL TO PROGRAM SOURCE CODE

OBJECTIVE

To maintain the security of application system software and information

PERFORMANCE INDICATOR

Number of cases where the change management processes have not been executed correctly

AUTOMATION GUIDANCE

Entity should adopt technical solutions to monitor application and program changes/updates

RELEVANT THREATS AND VULNERABILITIES

1. Unsuitable security for development and support processes
2. Lack of proper technical review of applications after operating system changes
3. Leakage of information

APPLICABLE CONTROLS

Followings are controls applicable for this control family.

• T7.6.1 - P3 - CHANGE CONTROL PROCEDURES
• T7.6.2 - P3 - TECHNICAL REVIEW OF APPLICATIONS AFTER OPERATING SYSTEM CHANGES
• T7.6.3 - P2 - RESTRICTIONS ON CHANGES TO SOFTWARE PACKAGES
• T7.6.4 - P2 - INFORMATION LEAKAGE
• T7.6.5 - P3 - OUTSOURCED SOFTWARE DEVELOPMENT

OBJECTIVE

To protect against supply chain threats and secure the supply of information systems

PERFORMANCE INDICATOR

Percentage of information systems received within the acceptable time frame and validated as genuine

Number of vendors/third parties compliant with the policy for acquisition of products and services

AUTOMATION GUIDANCE

An automated support system should be used to support tracking of products and services received and verification of compliance to

entity policies

RELEVANT THREATS AND VULNERABILITIES

1. Unsuitable supply chain strategy
2. Use of counterfeit or copied software

APPLICABLE CONTROLS

Followings are controls applicable for this control family.

• T7.8.1 - P4 - SUPPLY CHAIN PROTECTION STRATEGY
• T7.8.2 - P4 - SUPPLIER REVIEWS
• T7.8.3 - P4 - LIMITATION OF HARM
• T7.8.4 - P4 - SUPPLY CHAIN OPERATIONS SECURITY
• T7.8.5 - P4 - RELIABLE DELIVERY
• T7.8.6 - P3 - PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES
• T7.8.7 - P4 - SUPPLY OF CRITICAL INFORMATION SYSTEMS COMPONENTS