CyberStrikeus/CyberStrike - Página 115

pw-6-2-pw62

Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved c

Idioma del texto original: inglés

pw-7-1-pw71

Determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, either

Idioma del texto original: inglés

pw-7-2-pw72

Perform the code review and/or code analysis based on the organization’s secure coding standards, and record and triage all discovered issues and reco

Idioma del texto original: inglés

pw-8-1-pw81

Determine whether executable code testing should be performed to find vulnerabilities not identified by previous reviews, analysis, or testing and, if

Idioma del texto original: inglés

pw-8-2-pw82

Scope the testing, design the tests, perform the testing, and document the results, including recording and triaging all discovered issues and recomme

Idioma del texto original: inglés

pw-9-1-pw91

Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the default

Idioma del texto original: inglés

pw-9-2-pw92

Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.

Idioma del texto original: inglés

rv-1-1-rv11

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the

Idioma del texto original: inglés

rv-1-2-rv12

Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

Idioma del texto original: inglés

rv-1-3-rv13

Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that

Idioma del texto original: inglés

rv-2-1-rv21

Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.

Idioma del texto original: inglés

rv-2-2-rv22

Plan and implement risk responses for vulnerabilities.

Idioma del texto original: inglés

rv-3-1-rv31

Analyze identified vulnerabilities to determine their root causes.

Idioma del texto original: inglés

rv-3-2-rv32

Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.

Idioma del texto original: inglés

rv-3-3-rv33

Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external rep

Idioma del texto original: inglés

rv-3-4-rv34

Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or

Idioma del texto original: inglés

ac-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] access control policy that: Procedures to facilitate the implemen

Idioma del texto original: inglés

ac-10-concurrent-session-control

Limit the number of concurrent sessions for each [organization-defined] to [organization-defined].

Idioma del texto original: inglés

ac-11-1-pattern-hiding-displays

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Idioma del texto original: inglés

ac-11-device-lock

Prevent further access to the system by [organization-defined] ;

Idioma del texto original: inglés

ac-12-1-user-initiated-logouts

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [organization-defined].

Idioma del texto original: inglés

ac-12-2-termination-message

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

Idioma del texto original: inglés

ac-12-3-timeout-warning-message

Display an explicit message to users indicating that the session will end in [organization-defined].

Idioma del texto original: inglés

ac-12-session-termination

Automatically terminate a user session after [organization-defined].

Idioma del texto original: inglés

ac-13-supervision-and-review-access-control

Supervision and Review — Access Control

Idioma del texto original: inglés

ac-14-1-necessary-uses

Necessary Uses

Idioma del texto original: inglés

ac-14-permitted-actions-without-identification-or-authentication

Identify [organization-defined] that can be performed on the system without identification or authentication consistent with organizational mission...

Idioma del texto original: inglés

ac-15-automated-marking

Automated Marking

Idioma del texto original: inglés

ac-16-1-dynamic-attribute-association

Dynamically associate security and privacy attributes with [organization-defined] in accordance with the following security and privacy policies as in

Idioma del texto original: inglés

ac-16-10-attribute-configuration-by-authorized-individuals

Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with

Idioma del texto original: inglés

ac-16-2-attribute-value-changes-by-authorized-individuals

Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and

Idioma del texto original: inglés

ac-16-3-maintenance-of-attribute-associations-by-system

Maintain the association and integrity of [organization-defined] to [organization-defined].

Idioma del texto original: inglés

ac-16-4-association-of-attributes-by-authorized-individuals

Provide the capability to associate [organization-defined] with [organization-defined] by authorized individuals (or processes acting on behalf of ind

Idioma del texto original: inglés

ac-16-5-attribute-displays-on-objects-to-be-output

Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [organization-de

Idioma del texto original: inglés

ac-16-6-maintenance-of-attribute-association

Require personnel to associate and maintain the association of [organization-defined] with [organization-defined] in accordance with [organization-def

Idioma del texto original: inglés

ac-16-7-consistent-attribute-interpretation

Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.

Idioma del texto original: inglés

ac-16-8-association-techniques-and-technologies

Implement [organization-defined] in associating security and privacy attributes to information.

Idioma del texto original: inglés

ac-16-9-attribute-reassignment-regrading-mechanisms

Change security and privacy attributes associated with information only via regrading mechanisms validated using [organization-defined].

Idioma del texto original: inglés

ac-16-security-and-privacy-attributes

Provide the means to associate [organization-defined] with [organization-defined] for information in storage, in process, and/or in transmission;

Idioma del texto original: inglés

ac-17-1-monitoring-and-control

Employ automated mechanisms to monitor and control remote access methods.

Idioma del texto original: inglés