Table of Contents
- #Overview | #Standards | #Getting Started | #Resources
- Security Requirements of Information Systems (ISO 14.1)
- Security in Development and Support Processes (ISO 14.2)
- Test Data (ISO 14.3)
- Correct Processing in Applications (ISO 12.2)
- Security of System Files (ISO 12.4)
Overview
Security can be incorporated into information systems acquisition, development and maintenance by implementing effective security practices in the following areas.
- Security requirements for information systems
- Correct processing in applications
- Security of system files
- Security in development and support processes
- Technical vulnerability management
Information systems security begins with incorporating security into the requirements process for any new application or system enhancement. Security should be designed into the system from the beginning. Security requirements are presented to the vendor during the requirements phase of a product purchase. Formal testing should be done to determine whether the product meets the required security specifications prior to purchasing the product.
Correct processing in applications is essential in order to prevent errors and to mitigate loss, unauthorized modification or misuse of information. Effective coding techniques include validating input and output data, protecting message integrity using encryption, checking for processing errors, and creating activity logs.
System files used by applications must be protected in order to ensure the integrity and stability of the application. Using source code repositories with version control, extensive testing, production back-off plans, and appropriate access to program code are some effective measures that can be used to protect an application's files.
Security in development and support processes is an essential part of a comprehensive quality assurance and production control process, and would usually involve training and continuous oversight by the most experienced staff.
Applications need to be monitored and patched for technical vulnerabilities. Procedures for applying patches should include evaluating the patches to determine their appropriateness, and whether or not they can be successfully removed in case of a negative impact.
#Top of page
Standards
27002:2013 Information Security Management |
800-53: Recommended Security Controls for Federal Information |
APO01.06 |
Req 2 |
PR.DS-2 |
45 CFR 164.308(a)(5) |
#Top of page
Getting Started
Introductory material for the entire category. (Optional section)
#Top of page
Security Requirements of Information Systems (ISO 14.1)
Objective: To ensure that security requirements are established as an integral part of the development or implementation of an information system.
The University of Illinois Urbana-Champaign has developed a procurement process for evaluating whether an electronic service is considered to be low-risk, and potentially eligible for purchase using a P-Card. The criteria are included in Purchasing Software and Electronic Services with a P-Card.
Many institutions are looking to the cloud for information system solutions. Cloud Computing Security considerations are essential! Security professionals from EDUCAUSE member institutions published an excellent article, Cloud Services: Policy and Assessment, in the EDUCAUSE Review. Evaluating Cloud Risk for the Enterprise: A Shared Assessments Guide provides information to consider in evaluating the risk of moving applications to the cloud. Institutions need to perform due diligence to assess the security of cloud service providers. The Cloud Security Alliance has also published several resources to help assess security of cloud services. The Cloud Controls Matrix may prove particularly beneficial to those who are evaluating services prior to purchase.
George Mathew outlined security considerations for applications in the cloud at the 2011 Security Professionals conference. His Application Security in the Cloud session was recorded. Navigating the Clouds with an Enterprise IT Strategy, presented at the 2013 Security Professionals Conference, offers guidance from Furman University on creating a cloud security strategy. The University of Pennsylvania shared experience, lessons learned, and recommendations for creating a cloud policy, contracted solutions, and security assessments in Bring Your Own Cloud: Data management challenges in a click-through world, a presentation at the 2013 Security Professionals Conference.
As applications are developed for mobile computing, security requirements need to be included from the beginning. Developing a Campus Mobile Strategy: Guidelines, Tools, and Best Practices is an EDUCAUSE resource that offers an excellent strategy for mobile devices, including security considerations. The Hot Topic page on Mobile Device Security also contains numerous tips and links on how to secure mobile devices.
Applications often include data bases for backend processing. In the following case study, UC, Irvine provides a security checklist for data base administrators.
Campus Case Study: Application Security for Database Administrators - UC, Irvine
An important aspect of overall information systems design involves the credentials that will be used to access the system. The InCommon Identity Assurance Profiles Bronze and Silver (IAP) document specifies requirements that Identity Provider Operators must meet in order to be eligible to include InCommon Identity Assurance Qualifiers in Identity Assertions that they offer to Service Providers. The IAP provides excellent security requirements for identity management systems. In particular, Section 4.2.3, Credential Technology specifies requirements for issuing and securing credentials. Further guidance involving credential technology can be found in NIST SP 800-63.
#Top of page
Security in Development and Support Processes (ISO 14.2)
Objective: To ensure that change management and verification procedures are in place to maintain the security of project and support environments.
The Information Technology Infrastructure Library (ITIL) is one of the oldest and most mature frameworks for IT service management, and offers a wealth of best practice documents.
JIRA is a project tracking tool that is very useful for bug tracking and change management. Jira workflows can be customized and used to formalize testing procedures.
The following institutional case studies break down application security by the respective audience - management and architects, developers and QA staff, and the database administrator. Each area is instrumental in providing the comprehensive approach to ensure application layer security.
Campus Case Study: Application Security for Management, Project Managers, and Architects - UC, Irvine
Campus Case Study: Application Security for Developers and Quality Assurance Personnel - UC, Irvine
The need for highly skilled developers and support personnel cannot be emphasized enough. Security training is expensive, but can save the institution both dollars and reputation in the long run. The SysAdmin, Audit, Networking, and Security (SANS) EDU program is a partnership that helps to lower the cost of training for higher education security professionals. Relevant courses for software developers are listed in the SANS Secure Software Development Training Curriculum. System administrators will benefit from the SANS System Administration Training Curriculum.
At the 2013 Security Professionals Conference, the University of Pennsylvania presented a valuable methodology for securing web applications in Proven Strategies for Web Application Security.
#Top of page
Test Data (ISO 14.3)
Objective: To ensure the protection of data used for testing.
Data used in testing environments such as Quality Assurance (QA), test and development are protected against unauthorized access. Where possible data used for testing should not contain personally identifiable information. Guidelines for Data De-Identification should be followed to remove sensitive information or to modify it beyond recognition when used for testing purposes.
#Top of page
Correct Processing in Applications (ISO 12.2)
Objective: To ensure that application design includes controls such as those to validate input/output data, internal processing, and message integrity, in order to prevent errors and preserve data integrity.
#Top of page
Security of System Files (ISO 12.4)
Objective: To ensure that system files and sensitive data in testing environments are protected against unauthorized access, and that secure code management systems and processes are in place for configurations, software, and source code.
Data used for testing should not contain personally identifiable information. Guidelines for Data De-Identification should be followed to remove sensitive information or to modify it beyond recognition when used for testing purposes.
The integrity of system files can be compromised as a result of a security exploit. Running a package such as Tripwire can help detect unautohorized changes to system files. Tripwire is available in both commercial and open source versions.
#Top of page
Resources
Campus Case Studies On This Page
Application Security for Management, Project Managers, and Architects - UC, Irvine
Application Security for Developers and Quality Assurance Personnel - UC, Irvine
Application Security for Database Administrators - UC, Irvine
Enhancing Application Security with a Web Application Firewall - UC, Irvine
EDUCAUSE Resources
- Applications Development
- Information Systems and Services
- Mastering Puppet: Using Puppet to Centrally Manage IT Security Infrastructure
- Application Security and Software Development Life Cycle
- Building Security into the RFP Process
- Guidelines for Data De-Identification or Anonymization
- Cloud Computing Security
- Application Security in the Cloud
- Cloud Services: Policy and Assessment
- Developing a campus Mobile Strategy: Guidelines, Tools, and Best Practices
- Mobile Device Security
- Navigating the Clouds with an Enterprise IT Strategy
- Bring Your Own Cloud: Data management challenges in a click-through world
- Proven Strategies for Web Application Security
- Rapid Windows Analysis
Initiatives, Collaborations, & Other Resources
Questions or comments? Contact us.
Except where otherwise noted, this work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).