NIST Introduces Framework for Secure Software Development

guest · May 10, 2020

NIST Introduces Framework for Secure Software Development
May 8, 2020
https://www.veracode.com/blog/security-news/nist-introduces-framework-secure-software-development

NIST Cybersecurity recently published a whitepaper outlining software development practices, known collectively as a secure software development framework (SSDF), that can be implemented into the software development lifecycle (SDLC) to better secure applications. The outlined practices are based on pre-established standards and guidelines as well as software development practice documents.

NIST Cybersecurity states that, if properly implemented, the SSDF practices should, “help software producers reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences.”

Some of the key tasks outlined in the framework include:
Click to expand...

Provide secure code training
Most developers aren’t formally trained in writing secure code
To ensure successful training on secure code practices, tailor the training to specific roles, document the desired outcomes, and review the training plans periodically.
Automate and integrate security tests
By leveraging automatic testing methods instead of using a manual process, you can improve consistency, accuracy, and comprehensiveness.
Once you’ve selected your application security tests, they should be integrated into the developers existing workflows and processes.
Use open source code securely
Open source code, and all other third-party code, is still susceptible to vulnerabilities and flaws. Start by seeing if there are any publicly known flaws in the software modules that the vendor failed to fix.
Click to expand...

NIST: Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF)

A new NIST Cybersecurity White Paper has been published today: Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF). It recommends a core set of high-level secure software development practices—called a secure software development framework (SSDF)—to be added to each software development life cycle (SDLC) implementation.

The paper facilitates communications about secure software development practices amongst business owners, software developers, and cybersecurity professionals within an organization. Following these practices should help software producers reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Software consumers can reuse and adapt the practices in their software acquisition processes.
Click to expand...

guest · Oct 4, 2021

Secure Software Development Framework (SSDF) Draft Update Available for Comment
September 30, 2021
https://www.nist.gov/news-events/ne...framework-ssdf-draft-update-available-comment

The National Institute of Standards and Technology (NIST) has released a new draft document, NIST Special Publication (SP) 800-218, Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities.

This document will replace the NIST Cybersecurity White Paper released in April 2020 which defined the original SSDF, and it includes a change log summarizing the major changes from the April 2020 version. NIST used inputs from the public and its June 2021 workshop to shape SSDF version 1.1 in support of NIST's responsibilities under Executive Order (EO) 14028. The new SSDF draft also includes mappings from EO 14028 clauses to the SSDF practices and tasks that help address each clause.
Click to expand...

The public comment period for this draft is open through November 5, 2021.
Click to expand...

Log in or Sign up

NIST Introduces Framework for Secure Software Development

guest Guest

guest Guest

Log in or Sign up

NIST Introduces Framework for Secure Software Development

guest Guest

guest Guest

Useful Searches