Introduction

0.1 General

A systematic approach to integrate security controls throughout the engineering lifecycle provides an organization with evidence that information being used or stored by its applications is being adequately protected.

The ISO/IEC 27034 series assists organizations in integrating security throughout the life cycle of their applications by providing frameworks and processes scoped at organization and application levels.

This document defines the processes required for managing the security of an application identified as processing critical information by the organization.

Table 1 — ISO/IEC 27034 Framework overview

Scope	ISO/IEC 27034 framework	What it represents
Organization	Organization Normative Framework (ONF)	One centralized repository of application security information
Organization	ONF Management process	Process is in place to maintain and continuously improve ONF
Application	Application Normative Framework (ANF)	Repository for all ASCs of an application
Application	Application Security Management Process	A risk based process that uses the ANF to build and validate applications

As shown in Table 1, organization-level framework and process are provided by the Organization Normative Framework (ONF). The ONF, its elements and supporting processes are defined in ISO/IEC 27034‑2.

Application-level framework and processes are provided by this document in Clauses 5, 6 and 7. The Application Security Management Process (ASMP) helps a project team apply relevant portions of the ONF to a specific application project and formally record evidence of the outcomes in an Application Normative Framework (ANF).

Processes for determining the application requirements and environment are included in 6.1 to 6.5. Subclause 6.1 addresses the identification of the application requirements and its environment, assessing the application security risks. Evaluating the application's Targeted Level of Trust is addressed in 6.2, creating and maintaining the ANF and Application Security Controls (ASCs) is covered in 6.3, and processes pertaining to realizing and operating the application are included in 6.4. Finally, 6.5 presents a process to verify that the ANF and the ASCs are properly implemented.

0.2 Purpose

The purpose of this document is to provide requirements and guidance for the Application Security Management Process and the Application Normative Framework.

0.3 Targeted audience

0.3.1 General

Although this document provides best practices for a general audience, it is especially useful for the following actors:

a) managers;
b) provisioning and operation team;
c) acquirers;
d) suppliers;
e) auditors;
f) users.

0.3.2 Managers

Managers are persons involved in the management of an application. Examples of managers are:

a) information security managers including the Chief Information Security Officer (CISO);
b) project managers;
c) product line managers;
d) development managers;
e) application owners;
f) line managers including the Chief Information Officer (CIO), who supervise employees.

Typically, managers need to:

a) ensure that any application projects, initiatives or processes are based on the results of risk management;
b) make sure that certain proper information security clearances are in place as required by applicable information security policies and procedures;
c) manage the implementation of a secure application;
d) provide security awareness, training and oversight to all actors;
e) balance the cost of implementing and maintaining application security against the risks and value it represents for the organization;
f) ensure compliance with standards, laws and regulations according to an application’s regulatory context;
g) ensure the documentation of security policies and procedures for the application;
h) stay abreast of all application-related security plans throughout the organization's network;
i) determine which security controls and corresponding verification measurements should be implemented and tested;
j) authorize the targeted level of trust according to the context specific to the organization;
k) periodically review the applications for security weaknesses and threats and take corrective and preventive actions;
l) review auditor reports recommending application acceptance or rejection based on proper implementation of required application security controls;
m) ensure that security flaws are prevented through secure coding practices;
n) base their decisions on lessons learned derived from knowledge base records.

0.3.3 Provisioning and operation team

Members of provisioning and operation team (known collectively as the project team or as the application team) are persons involved in an application’s design, development and maintenance throughout its whole life cycle. Example provisioning and operations team roles include:

a) architects;
b) analysts;
c) programmers;
d) testers;
e) IT administrators, such as system administrators, database administrators, network administrators, and application administrators.

Typically, members need to:

a) understand which application security controls should be applied at each stage of an application's life cycle and why;
b) understand which controls should be implemented in the application itself;
c) minimize the impact of introducing controls into the development, test and documentation activities within the application life cycle;
d) make sure that introduced controls meet the requirements;
e) obtain access to tools and best practices in order to streamline development, testing and documentation;
f) facilitate peer review;
g) participate in acquisition planning and strategy;
h) arrange disposal of residual items after work is completed, (e.g. property management/disposal).

0.3.4 Acquirers

This includes all persons involved in acquiring a product or service.

Typically, acquirers need to:

a) establish business relationships to obtain needed goods and services, (e.g. for the solicitation, evaluation and awarding of contracts);
b) prepare requests for proposals that include requirements for security controls;
c) select suppliers that comply with such requirements;
d) verify evidence of security controls applied by outsourcing services;
e) evaluate products by verifying evidence of correctly implemented application security controls.

0.3.5 Suppliers

This includes all persons involved in supplying a product or service.

Typically suppliers need to:

a) comply to application security requirements from requests for proposals;
b) select appropriate application security controls for proposals, with respect to their impact on cost;
c) provide evidence that required security controls are implemented correctly in proposed products or services.

0.3.6 Auditors

Auditors are persons who need to:

a) understand the scope and procedures involved in verification measurements for the corresponding controls;
b) ensure that audit results are repeatable;
c) establish a list of verification measurements which generate evidence that an application has reached the Targeted Level of Trust;
d) apply standardized audit processes based on the use of verifiable evidence, according to ISO/IEC 27034 (all parts).

0.3.7 Users

Users are persons who need to trust that:

a) it is deemed secure to use or deploy an application;
b) an application produces reliable results consistently and in a timely manner;
c) the controls and their corresponding verification measurements are positioned and functioning correctly as expected.

BS ISO/IEC 27034-3:2018

Information technology. Application security - Application security management process

Current

Published:

31 May 2018