System Guides

A.8.27 Secure System Architecture and Engineering Principles would include:

1. Secure Architecture Design: Documentation of the system's architecture design that incorporates security principles, such as defense in depth, least privilege, and separation of duties.

2. Threat Modeling: Evidence of threat modeling exercises conducted during the system's design phase to identify potential security threats and vulnerabilities.

3. Security Controls: Documentation of security controls implemented at the architectural level to mitigate identified risks and protect critical assets.

4. Secure Development Framework: Evidence of the use of secure development frameworks or methodologies that promote secure architecture and engineering practices.

5. Security Review Reports: Reports from security reviews and assessments conducted by qualified security experts to evaluate the system's architecture for security flaws and design weaknesses.

6. Secure Coding Guidelines: Evidence that secure coding guidelines and practices are integrated into the system's development process to ensure secure engineering.

7. Component Review: Documentation of security reviews conducted for each component or module of the system to assess its security features and potential vulnerabilities.

8. Security by Design Principles: Information on the implementation of security by design principles, ensuring that security considerations are incorporated from the system's inception.

9. Compliance with Security Standards: Verification that the system's architecture complies with relevant security standards and best practices, such as ISO/IEC 27001, NIST Cybersecurity Framework, or other industry-specific guidelines.

10. Security Testing: Evidence of security testing conducted on the system's architecture to validate its resilience against security threats and attacks.

11. Secure Configuration Management: Documentation of secure configuration management practices, ensuring that the system's components are properly configured to minimize security risks.

12. Secure Protocols and Standards: Information on the use of secure communication protocols and cryptographic standards to protect data in transit and at rest.

By examining these pieces of evidence, an auditor can assess the organization's adherence to secure system architecture and engineering principles. The goal is to verify that security is an integral part of the system's design, development, and deployment, reducing the likelihood of security incidents and ensuring the protection of sensitive information and critical assets.

A.8.28 Secure Coding would include:

1. Secure Coding Policy: Documentation of a formal policy or guideline that outlines secure coding practices to be followed by developers during the software development process.

2. Secure Coding Training: Evidence that developers have received training on secure coding practices, including the topics covered, training materials, and attendance records.

3. Code Review Reports: Reports from code reviews conducted by qualified security experts to assess the security of the application's source code and identify potential security flaws.

4. Code Analysis Tools: Information on the use of automated code analysis tools to identify security vulnerabilities and coding errors in the application code.

5. Code Samples: Samples of code demonstrating the implementation of secure coding practices, such as input validation, output encoding, and protection against common security issues (e.g., SQL injection, cross-site scripting).

6. Security Frameworks: Documentation showing the use of secure coding frameworks or libraries that offer security controls to assist developers in building secure applications.

7. Secure Development Guidelines: Evidence of the integration of secure coding guidelines into the software development process and the measures taken to ensure adherence to these guidelines.

8. Developer Responsibilities: Information on how developers are held accountable for following secure coding practices, such as code reviews, peer assessments, or other quality control mechanisms.

9. Security Bug Tracking: Evidence of a process to track and manage security-related bugs and issues discovered during the development process and their resolution.

10. Incident Response: Documentation of procedures to handle and respond to security incidents related to coding vulnerabilities discovered during development.

11. Continuous Improvement: Evidence of continuous efforts to improve secure coding practices based on lessons learned from previous security assessments or incidents.

12. Compliance with Standards: Verification that the organization's coding practices align with relevant security standards, such as the OWASP Top Ten or other industry best practices.

By reviewing these pieces of evidence, you can assess the organization's commitment to implementing secure coding practices and evaluate the level of security awareness among developers. The goal is to ensure that the application code is developed with security in mind, minimizing the risk of introducing security vulnerabilities that could be exploited by attackers.