Menu

    How Secure Code Warrior can assist you in achieving Compliance

    Avatar
    Secure Code Warrior Elves
    • Updated
    Follow

    IMPORTANT: Secure Code Warrior is NOT a compliance expert or consultant. This article is intended as a general guide and offers insights based on publicly available information for each standard and should not be interpreted as specific auditing advice.

     



    PCI DSS

    PCI DSS was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirements designed to protect account data. It applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers. PCI DSS also applies to all other entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD). 

     

    PCI DSS v4.0 provides 12 requirements grouped into 6 control objectives:

    • Control Objective 1: Build and Maintain a Secure Network and Systems
    • Control Objective 2: Protect Cardholder Data
    • Control Objective 3: Maintain a Vulnerability Management Program
    • Control Objective 4: Implement Strong Access Control Measures
    • Control Objective 5: Regularly Monitor and Test Networks
    • Control Objective 6: Maintain an Information Security Policy

    Secure Code Warrior helps meet 8 of these requirements, covering 5 out of the 6 control objectives, which are the most directly related to developers' work.

     

    Check our prebuilt course template for PCI DSS v4.0 Recommendations.


    ISO 27001 control requirements

    At the very core of the standard, Objective A.7.2.2 states that “Information security awareness, education, and training needs to be delivered to all employees as relevant to their job function.” Not only that, but contractors also need to be given this awareness training. Developers and other engineers need to master the fundamentals of software security to be able to avoid costly mistakes. This typically goes beyond the basic requirements and it is recommended that developers continuously invest time in learning software security and reliability.

    Objective A.14.2 specifically calls for security in development processes. It starts with establishing a secure development policy that applies to the Secure Development Lifecycle (SDLC)

    Objective A.14.2.3. in particular demands testing and reviewing of each application.

    Objective A.14.2.5 requires secure system engineering principles to be implemented for any information system. When vulnerabilities are discovered, there should be a technical vulnerability management process (A.12.6) to prevent the exploitation of these vulnerabilities. Without proper secure coding training the developers at the organization might not be prepared to remediate these vulnerabilities, or the vulnerability management might become too costly for the company.

    In addition to the above in the newly revised ISO 27001:2022, there is this requirement - Annex A Control 8.28 assists organisations in preventing security risks and vulnerabilities that may arise due to poor software coding practices through developing, implementing, and reviewing appropriate secure software coding practices.

    Recommendations of courses to select from the SCW Platform. Either all or a combination of the courses listed below:

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Security Requirements
    • Threat Modeling
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure

     

     

    SOC 2 - Type 2

    SOC 2 although not prescriptive on the requirements for developer training, more broadly, requires the following.

    • Employees complete security awareness training upon hire, and annually thereafter, to understand their obligations and responsibilities to comply with the corporate security policies.

      Service Organizations can incorporate training for developers in addition to general security training under this control.

    • A policy and procedure for secure code development and testing. This may include secure code training for developers and testers, as well as tools and methods to identify and remediate vulnerabilities in the code. The exact scope and content of the policy may vary depending on the nature and complexity of the service organization’s code and systems. As a general guide, an organization may wish to consider the following with regard to the policy

    • Secure coding best practices and standards: Service Organizations can incorporate developer training to show their commitment to Secure coding best practices.

    • Common vulnerabilities and how to avoid them

    • Secure code review and testing tools and methods

    • Incident response and remediation procedures

    Recommendations of courses to select from the SCW Platform. Either all or a combination of the courses listed below.

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Security Requirements
    • Threat Modeling
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure



    GDPR

    Article 5(f) - Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures (integrity and confidentiality).

     

    Article 32 - Organisations are required to implement appropriate technical and organisational measures to protect personal data based on risk, technological advancements, and specific processing contexts to safeguard individual rights effectively. Continuous developer training is required to demonstrate compliance with the GDPR’s data protection principles (Article 5 - Accountability) and ensure developers can sufficiently take into account the "state of the art" (i.e. the highest level of development of existing techniques and technologies) when:

    • implementing technical measures to safeguard personal data (Article 32), and integrating privacy-protective practices into data processing activities at their inception and throughout their lifecycle (Article 25 - Data protection by design and default).

    • Regular training ensures that the security measures are consistently applied across all processes and that new staff are equally informed about the regulatory requirements and technical standards.



    Recommendations of courses to select from the SCW Platform. Either all or a combination of the courses listed below.

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Foundations of Software Security
    • Security Requirements
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure

    HIPAA

    The Security Rule (45 CFR 164) requires entities to protect the health information they process and follow specific standards and implementation recommendations. Elements of the Security Rule are outlined below:

    • General principle (45 CFR 164.306) - Entities must ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) and protect against:
        • reasonably anticipated threats or hazards to the security or integrity of such information
        • reasonably anticipated uses or disclosures of such information that are not permitted or required

    • Administrative Safeguards (45 CFR § 164.308) - Entities must implement policies and procedures to prevent, detect, contain, and correct security violations.

      This includes ensuring that the workforce is properly trained and supervised and that there is a security management process in place to identify and mitigate risks to ePHI.



    • Technical Safeguards (45 CFR § 164.312) - Entities must implement technical policies and procedures that allow only authorised persons to access ePHI. This includes access control measures, audit controls, integrity controls to ensure ePHI is not improperly altered or destroyed, and transmission security to guard against unauthorised access to ePHI that is being transmitted over an electronic network.

    Although directly called out as part of the administrative safeguards, training is also implied under HIPPA’s general reference to “reasonably anticipated threats/uses”. It would be reasonable for a developer to have up-to-date knowledge of known vulnerabilities and measures required to properly safeguard ePHI.



    Recommendations of courses to select from the SCW Platform. Either all or a combination of the courses listed below.

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Foundations of Software Security
    • Security Requirements
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure


    NIS2

    • Competent Authority Oversight
      NIS2 Article 8, mandates that each EU member state appoint a competent authority responsible for overseeing the application of the directive within its territory. These authorities are tasked with ensuring that entities subject to NIS2 comply with its requirements, including those related to secure code training.

    • Security Measures for Operators of Essential Services (OES):
       Referring to Article 14, NIS2 requires OES, such as operators in sectors like energy, transportation, health, and finance, to implement appropriate security measures to manage the risks posed to the security of networks and information systems. Secure code training for relevant personnel can be considered one of these security measures.

    • Risk Management:
      NIS2 emphasizes the importance of risk management in enhancing cybersecurity. Secure code training can be considered a proactive measure to mitigate the risk of software vulnerabilities and breaches resulting from insecure code practices.
        • Risk Management (Article 21): Organizations must identify and manage cybersecurity risks. Secure coding practices significantly reduce vulnerabilities in software, mitigating a major risk factor.
        • Cyber Hygiene Practices (Article 21): The directive encourages basic cyber hygiene practices, which often encompass secure coding principles like proper input validation and secure data handling.

    • Security by Design and by Default:
       In several Articles - 14, 16, and 18, NIS2 promotes the principles of security by design and by default, requiring that security considerations be integrated into the development of products and services from the outset. Recital 54, of the NIS 2 proposal explicitly mentions the "principle" of Security by Design, linking it to the requirements of Article 18. Although recitals are not legally binding, they offer valuable context for interpreting the Directive's intent. Secure code training plays a crucial role in fostering a security-conscious development culture where developers prioritize security throughout the software development lifecycle. In essence, while there's no single chapter on Security by Design in NIS2, various Articles promote this concept by advocating for preventative security measures and a risk-based approach.

    Recommendations of courses to select from the SCW Platform. Either all or a combination of the courses listed below.

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Secure Code Warrior Recommendations
    • Security Requirements
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure
    • Threat Modeling


    NIST

    The National Institute of Standards and Technology (NIST) provides guidelines and recommendations for various aspects of cybersecurity, including secure code training. While NIST does not have specific requirements like a regulatory body, it offers guidance and best practices that organizations can adopt to improve their cybersecurity posture. Here are some key points from NIST's guidance on secure code training:

    • NIST Special Publication 800-53:
       This publication provides a catalog of security and privacy controls for federal information systems and organizations. While it doesn't specifically address secure code training, it emphasizes the importance of training and awareness programs as part of an organization's overall security program.

    • NIST Special Publication 800-64:
      This publication focuses on providing guidance for managing information security risks. It highlights the importance of security training for developers and other personnel involved in the software development lifecycle. While it doesn't provide specific training requirements, it emphasizes the need for organizations to tailor their training programs based on their specific needs and risks.

        • NIST Special Publication 800-64 Revision 2: This revision updates the guidance provided in SP 800-64, emphasizing the importance of integrating security into the software development lifecycle. It recommends training developers on secure coding practices and techniques to identify and mitigate common vulnerabilities.

    • NIST Cybersecurity Framework (CSF):
      The NIST CSF provides a framework for organizations to manage and improve their cybersecurity posture. While it doesn't prescribe specific training requirements, it emphasizes the importance of cybersecurity awareness and training as part of an organization's efforts to identify, protect, detect, respond to, and recover from cybersecurity risks.

    • NIST Secure Software Development Framework (SSDF):
      While not a set of requirements, the SSDF outlines practices for secure software development. One of these practices, PW.5: Create Source Code by Adhering to Secure Coding Practices, highlights the importance of training developers in secure coding techniques. This practice provides details on how to implement secure coding practices, including using development environments that provide in-place training.

    Recommendations of courses to select from the SCW Platform. Either all or a combination of the courses listed below.

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Security Measures for “EO-Critical Software” Use Under Executive Order (EO) 14028
    • Secure Code Warrior Recommendations
    • Security Requirements
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure
    • Threat Modeling


    FedRAMP

    FedRAMP (Federal Risk and Authorization Management Program) is a framework designed for government agencies. The framework provides standardized guidelines that can enable federal agencies to evaluate cyber threats and risks to the different infrastructure platforms and cloud-based services and software solutions.

    The framework is also based on the continuous monitoring of IT infrastructure and cloud products to facilitate a real-time cybersecurity program. More importantly, FedRAMP focuses on shifting from tedious, tethered, and insecure IT to more secure mobile and quick IT. The aim is to ensure federal agencies have access to modern and reliable technologies without compromising their security.

    To achieve the desired security levels, FedRAMP collaborates with cloud and cybersecurity experts to maintain other security frameworks. These include NSA, DoD, NIST, GSA, OMB, and other private sector groups.

    Here's how FedRAMP relates to secure coding:

    • Security Controls: FedRAMP mandates the implementation of a comprehensive set of security controls. These controls often include requirements related to secure coding practices, such as:
      • Input validation
      • Output encoding
      • Access controls
      • Error handling
      • Cryptographic practices
    • Third-Party Assessments: FedRAMP requires cloud service providers (CSPs) to undergo independent security assessments. These assessments often include reviews of the CSP's secure coding practices and adherence to industry standards like OWASP Top 10.

    • Continuous Monitoring: FedRAMP requires continuous monitoring of cloud services to ensure ongoing compliance with security requirements. This includes monitoring for vulnerabilities that may arise due to insecure coding practices.

    • Compliance with Other Standards: FedRAMP often references other security standards, such as NIST 800-53, which also include requirements related to secure coding.

    Recommendations of courses to select from the SCW Platform. Either all or a combination of the courses listed below.

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Security Measures for “EO-Critical Software” Use Under Executive Order (EO) 14028
    • Secure Code Warrior Recommendations
    • Security Requirements
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure
    • Threat Modeling

     

    HITRUST

    HITRUST Common Security Framework (CSF) includes risk analysis and risk management frameworks, along with operational requirements. The framework has 14 different control categories and can be applied to almost any organization, including healthcare.

    The framework was developed to cater to the security issues organizations within the health industry face when managing IT security. This is through providing such institutions with efficient, comprehensive, and flexible approaches to managing risks and meeting various compliance regulations.

    In particular, the framework integrates various compliance regulations for securing personal information. Such include Singapore’s Personal Data Protection Act and interprets relevant requirement recites from the General Data Protection Regulation.

    Here's how HITRUST relates to secure coding:

    • Security Controls: HITRUST's CSF (Common Security Framework) outlines a set of security controls that organizations must implement to protect sensitive health information. Many of these controls directly relate to secure coding practices, such as:
        • Input validation
        • Output encoding
        • Access controls
        • Error handling
        • Cryptographic practices

    • Assessment and Certification: HITRUST offers a certification process that involves a rigorous assessment of an organization's security controls and compliance with the CSF. This includes evaluating the security of the organization's software development practices and ensuring that they adhere to secure coding principles.

    • Third-Party Assessments: HITRUST requires organizations to undergo independent assessments by authorized assessors. These assessments often include reviews of the organization's secure coding practices and adherence to industry standards like OWASP Top 10.

    • Continuous Monitoring: HITRUST requires organizations to implement continuous monitoring processes to ensure ongoing compliance with the CSF. This includes monitoring for vulnerabilities that may arise due to insecure coding practices.

    Recommendations of courses to select from the SCW Platform

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Secure Code Warrior Recommendations
    • Security Requirements
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure



    DORA

    The Digital Operational Resilience Act, or DORA, is a European Union (EU) regulation that creates a binding, comprehensive information and communication technology (ICT) risk management framework for the EU financial sector.

    DORA establishes technical standards that financial entities and their critical third-party technology service providers must implement in their ICT systems by 17 January 2025.

    While DORA doesn't directly address secure coding standards, it creates a regulatory environment where financial institutions are incentivized to adopt best practices in software development and security. By ensuring that their software is developed securely, financial institutions can meet the requirements of DORA and enhance their operational resilience.

    Here's how DORA relates to secure coding:

    • Incident Management: DORA requires financial institutions to have robust incident management frameworks in place. Secure coding practices can help prevent incidents that could disrupt critical operations, such as data breaches or system failures.

    • Third-Party Risk Management: DORA emphasizes the importance of managing risks associated with third-party service providers. Secure coding practices can help mitigate risks when dealing with third-party software components or services.

    • Technology Risk Management: DORA requires financial institutions to have a comprehensive technology risk management framework. Secure coding practices are a fundamental aspect of mitigating technology risks, as vulnerabilities in software can lead to operational disruptions.

    • Business Continuity Management: DORA mandates business continuity planning to ensure that critical operations can continue in the event of a disruption. Secure coding can contribute to business continuity by reducing the likelihood of incidents that could trigger a continuity plan.

    Recommendations of courses to select from the SCW Platform

    • Introduction to OWASP Top 10 Awareness or In-depth OWASP Top 10 Awareness
    • Secure Code Warrior Recommendations
    • Security Requirements
    • Sensitive Data Storage
      • Plaintext Storage of Passwords
      • Plaintext Storage of Sensitive Information
    • Information Exposure
      • Sensitive Data Exposure

    Related articles

    Comments

    0 comments

    Article is closed for comments.