CyberStrikeus/CyberStrike - Page 115

pw-6-2-pw62

Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved c

Langue du texte source : anglais

pw-7-1-pw71

Determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, either

Langue du texte source : anglais

pw-7-2-pw72

Perform the code review and/or code analysis based on the organization’s secure coding standards, and record and triage all discovered issues and reco

Langue du texte source : anglais

pw-8-1-pw81

Determine whether executable code testing should be performed to find vulnerabilities not identified by previous reviews, analysis, or testing and, if

Langue du texte source : anglais

pw-8-2-pw82

Scope the testing, design the tests, perform the testing, and document the results, including recording and triaging all discovered issues and recomme

Langue du texte source : anglais

pw-9-1-pw91

Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the default

Langue du texte source : anglais

pw-9-2-pw92

Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.

Langue du texte source : anglais

rv-1-1-rv11

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the

Langue du texte source : anglais

rv-1-2-rv12

Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

Langue du texte source : anglais

rv-1-3-rv13

Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that

Langue du texte source : anglais

rv-2-1-rv21

Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.

Langue du texte source : anglais

rv-2-2-rv22

Plan and implement risk responses for vulnerabilities.

Langue du texte source : anglais

rv-3-1-rv31

Analyze identified vulnerabilities to determine their root causes.

Langue du texte source : anglais

rv-3-2-rv32

Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.

Langue du texte source : anglais

rv-3-3-rv33

Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external rep

Langue du texte source : anglais

rv-3-4-rv34

Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or

Langue du texte source : anglais

ac-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] access control policy that: Procedures to facilitate the implemen

Langue du texte source : anglais

ac-10-concurrent-session-control

Limit the number of concurrent sessions for each [organization-defined] to [organization-defined].

Langue du texte source : anglais

ac-11-1-pattern-hiding-displays

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Langue du texte source : anglais

ac-11-device-lock

Prevent further access to the system by [organization-defined] ;

Langue du texte source : anglais

ac-12-1-user-initiated-logouts

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [organization-defined].

Langue du texte source : anglais

ac-12-2-termination-message

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

Langue du texte source : anglais

ac-12-3-timeout-warning-message

Display an explicit message to users indicating that the session will end in [organization-defined].

Langue du texte source : anglais

ac-12-session-termination

Automatically terminate a user session after [organization-defined].

Langue du texte source : anglais

ac-13-supervision-and-review-access-control

Supervision and Review — Access Control

Langue du texte source : anglais

ac-14-1-necessary-uses

Necessary Uses

Langue du texte source : anglais

ac-14-permitted-actions-without-identification-or-authentication

Identify [organization-defined] that can be performed on the system without identification or authentication consistent with organizational mission...

Langue du texte source : anglais

ac-15-automated-marking

Automated Marking

Langue du texte source : anglais

ac-16-1-dynamic-attribute-association

Dynamically associate security and privacy attributes with [organization-defined] in accordance with the following security and privacy policies as in

Langue du texte source : anglais

ac-16-10-attribute-configuration-by-authorized-individuals

Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with

Langue du texte source : anglais

ac-16-2-attribute-value-changes-by-authorized-individuals

Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and

Langue du texte source : anglais

ac-16-3-maintenance-of-attribute-associations-by-system

Maintain the association and integrity of [organization-defined] to [organization-defined].

Langue du texte source : anglais

ac-16-4-association-of-attributes-by-authorized-individuals

Provide the capability to associate [organization-defined] with [organization-defined] by authorized individuals (or processes acting on behalf of ind

Langue du texte source : anglais

ac-16-5-attribute-displays-on-objects-to-be-output

Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [organization-de

Langue du texte source : anglais

ac-16-6-maintenance-of-attribute-association

Require personnel to associate and maintain the association of [organization-defined] with [organization-defined] in accordance with [organization-def

Langue du texte source : anglais

ac-16-7-consistent-attribute-interpretation

Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.

Langue du texte source : anglais

ac-16-8-association-techniques-and-technologies

Implement [organization-defined] in associating security and privacy attributes to information.

Langue du texte source : anglais

ac-16-9-attribute-reassignment-regrading-mechanisms

Change security and privacy attributes associated with information only via regrading mechanisms validated using [organization-defined].

Langue du texte source : anglais

ac-16-security-and-privacy-attributes

Provide the means to associate [organization-defined] with [organization-defined] for information in storage, in process, and/or in transmission;

Langue du texte source : anglais

ac-17-1-monitoring-and-control

Employ automated mechanisms to monitor and control remote access methods.

Langue du texte source : anglais