CyberStrikeus/CyberStrike - Página 115

pw-6-2-pw62

Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved c

Idioma do texto original: inglês

pw-7-1-pw71

Determine whether code review (a person looks directly at the code to find issues) and/or code analysis (tools are used to find issues in code, either

Idioma do texto original: inglês

pw-7-2-pw72

Perform the code review and/or code analysis based on the organization’s secure coding standards, and record and triage all discovered issues and reco

Idioma do texto original: inglês

pw-8-1-pw81

Determine whether executable code testing should be performed to find vulnerabilities not identified by previous reviews, analysis, or testing and, if

Idioma do texto original: inglês

pw-8-2-pw82

Scope the testing, design the tests, perform the testing, and document the results, including recording and triaging all discovered issues and recomme

Idioma do texto original: inglês

pw-9-1-pw91

Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the default

Idioma do texto original: inglês

pw-9-2-pw92

Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.

Idioma do texto original: inglês

rv-1-1-rv11

Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the

Idioma do texto original: inglês

rv-1-2-rv12

Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

Idioma do texto original: inglês

rv-1-3-rv13

Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that

Idioma do texto original: inglês

rv-2-1-rv21

Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.

Idioma do texto original: inglês

rv-2-2-rv22

Plan and implement risk responses for vulnerabilities.

Idioma do texto original: inglês

rv-3-1-rv31

Analyze identified vulnerabilities to determine their root causes.

Idioma do texto original: inglês

rv-3-2-rv32

Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.

Idioma do texto original: inglês

rv-3-3-rv33

Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external rep

Idioma do texto original: inglês

rv-3-4-rv34

Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or

Idioma do texto original: inglês

ac-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] access control policy that: Procedures to facilitate the implemen

Idioma do texto original: inglês

ac-10-concurrent-session-control

Limit the number of concurrent sessions for each [organization-defined] to [organization-defined].

Idioma do texto original: inglês

ac-11-1-pattern-hiding-displays

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Idioma do texto original: inglês

ac-11-device-lock

Prevent further access to the system by [organization-defined] ;

Idioma do texto original: inglês

ac-12-1-user-initiated-logouts

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [organization-defined].

Idioma do texto original: inglês

ac-12-2-termination-message

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

Idioma do texto original: inglês

ac-12-3-timeout-warning-message

Display an explicit message to users indicating that the session will end in [organization-defined].

Idioma do texto original: inglês

ac-12-session-termination

Automatically terminate a user session after [organization-defined].

Idioma do texto original: inglês

ac-13-supervision-and-review-access-control

Supervision and Review — Access Control

Idioma do texto original: inglês

ac-14-1-necessary-uses

Necessary Uses

Idioma do texto original: inglês

ac-14-permitted-actions-without-identification-or-authentication

Identify [organization-defined] that can be performed on the system without identification or authentication consistent with organizational mission...

Idioma do texto original: inglês

ac-15-automated-marking

Automated Marking

Idioma do texto original: inglês

ac-16-1-dynamic-attribute-association

Dynamically associate security and privacy attributes with [organization-defined] in accordance with the following security and privacy policies as in

Idioma do texto original: inglês

ac-16-10-attribute-configuration-by-authorized-individuals

Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with

Idioma do texto original: inglês

ac-16-2-attribute-value-changes-by-authorized-individuals

Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and

Idioma do texto original: inglês

ac-16-3-maintenance-of-attribute-associations-by-system

Maintain the association and integrity of [organization-defined] to [organization-defined].

Idioma do texto original: inglês

ac-16-4-association-of-attributes-by-authorized-individuals

Provide the capability to associate [organization-defined] with [organization-defined] by authorized individuals (or processes acting on behalf of ind

Idioma do texto original: inglês

ac-16-5-attribute-displays-on-objects-to-be-output

Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [organization-de

Idioma do texto original: inglês

ac-16-6-maintenance-of-attribute-association

Require personnel to associate and maintain the association of [organization-defined] with [organization-defined] in accordance with [organization-def

Idioma do texto original: inglês

ac-16-7-consistent-attribute-interpretation

Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.

Idioma do texto original: inglês

ac-16-8-association-techniques-and-technologies

Implement [organization-defined] in associating security and privacy attributes to information.

Idioma do texto original: inglês

ac-16-9-attribute-reassignment-regrading-mechanisms

Change security and privacy attributes associated with information only via regrading mechanisms validated using [organization-defined].

Idioma do texto original: inglês

ac-16-security-and-privacy-attributes

Provide the means to associate [organization-defined] with [organization-defined] for information in storage, in process, and/or in transmission;

Idioma do texto original: inglês

ac-17-1-monitoring-and-control

Employ automated mechanisms to monitor and control remote access methods.

Idioma do texto original: inglês