CyberStrikeus/CyberStrike - Page 115

pw-6-2-pw62

Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved c

pw-7-1-pw71

Determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, either

pw-7-2-pw72

Perform the code review and/or code analysis based on the organization’s secure coding standards, and record and triage all discovered issues and reco

pw-8-1-pw81

Determine whether executable code testing should be performed to find vulnerabilities not identified by previous reviews, analysis, or testing and, if

pw-8-2-pw82

Scope the testing, design the tests, perform the testing, and document the results, including recording and triaging all discovered issues and recomme

pw-9-1-pw91

Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the default

pw-9-2-pw92

Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.

rv-1-1-rv11

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the

rv-1-2-rv12

Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

rv-1-3-rv13

Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that

rv-2-1-rv21

Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.

rv-2-2-rv22

Plan and implement risk responses for vulnerabilities.

rv-3-1-rv31

Analyze identified vulnerabilities to determine their root causes.

rv-3-2-rv32

Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.

rv-3-3-rv33

Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external rep

rv-3-4-rv34

Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or

ac-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] access control policy that: Procedures to facilitate the implemen

ac-10-concurrent-session-control

Limit the number of concurrent sessions for each [organization-defined] to [organization-defined].

ac-11-1-pattern-hiding-displays

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

ac-11-device-lock

Prevent further access to the system by [organization-defined] ;

ac-12-1-user-initiated-logouts

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [organization-defined].

ac-12-2-termination-message

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

ac-12-3-timeout-warning-message

Display an explicit message to users indicating that the session will end in [organization-defined].

ac-12-session-termination

Automatically terminate a user session after [organization-defined].

ac-13-supervision-and-review-access-control

Supervision and Review — Access Control

ac-14-1-necessary-uses

Necessary Uses

ac-14-permitted-actions-without-identification-or-authentication

Identify [organization-defined] that can be performed on the system without identification or authentication consistent with organizational mission...

ac-15-automated-marking

Automated Marking

ac-16-1-dynamic-attribute-association

Dynamically associate security and privacy attributes with [organization-defined] in accordance with the following security and privacy policies as in

ac-16-10-attribute-configuration-by-authorized-individuals

Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with

ac-16-2-attribute-value-changes-by-authorized-individuals

Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and

ac-16-3-maintenance-of-attribute-associations-by-system

Maintain the association and integrity of [organization-defined] to [organization-defined].

ac-16-4-association-of-attributes-by-authorized-individuals

Provide the capability to associate [organization-defined] with [organization-defined] by authorized individuals (or processes acting on behalf of ind

ac-16-5-attribute-displays-on-objects-to-be-output

Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [organization-de

ac-16-6-maintenance-of-attribute-association

Require personnel to associate and maintain the association of [organization-defined] with [organization-defined] in accordance with [organization-def

ac-16-7-consistent-attribute-interpretation

Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.

ac-16-8-association-techniques-and-technologies

Implement [organization-defined] in associating security and privacy attributes to information.

ac-16-9-attribute-reassignment-regrading-mechanisms

Change security and privacy attributes associated with information only via regrading mechanisms validated using [organization-defined].

ac-16-security-and-privacy-attributes

Provide the means to associate [organization-defined] with [organization-defined] for information in storage, in process, and/or in transmission;

ac-17-1-monitoring-and-control

Employ automated mechanisms to monitor and control remote access methods.