Policy 7230A - Department of Administration

5.4. Application Protection
The following are the Non-Mandatory Baselines that support the Application
Protection section of the Default Security Requirements:
5.4.1. Apply Security Principles to Code Development
To ensure that information systems offer the appropriate level of security with
the greatest level of efficiency, Agencies should engineer controls into the
solution during development:
5.4.1.a Standard Development Practices
• Development processes should start with the creation and
documentation of a secure Concept of Operations (ConOps).
• Development processes should make use of documented and
repeatable standards and processes.
• Security training should be provided for the development
team.
• Quality management should be performed throughout the
development process.
• Code should be developed in a dedicated and secured
environment.
• Code should be stored in securely maintained repositories.
5.4.1.b Development Training Recommendations
• Development training should address all standard
development practices.
5.4.1.c Development Training Scheduling and Frequency
• Secure code development training should be provided for all
developers within 30 days of initial assignment of the
individual to the development team.
• Secure code development training should be provided
thereafter for all developers on an at least annual basis.
Where possible, team members will be trained together as a
group.
5.4.1.d Quality Assurance
• Code development quality assurance practices should focus
on the following:
o Cross-site scripting vulnerabilities.
o Buffer overflows.
o Race conditions.
o Object model violations.
o Poor user input validation.
o Poor error handling.
o Exposed security parameters.
14