ISO/IEC 27034 Information technology — Security techniques — Application security (part 1 published, rest in DRAFT)
ISO/IEC 27034 offers guidance on information security to those specifying, designing/programming or procuring, implementing and using application systems, in other words business and IT managers, developers and auditors, and ultimately the end-users of application systems. The aim is to ensure that computer applications deliver the desired/necessary level of security in support of the organization’s Information Security Management System.
The multi-part standard provides guidance on specifying, designing/selecting and implementing information security controls through a set of processes integrated throughout an organization’s Systems Development Life Cycle/s (SDLC). It is process-oriented.
It covers software applications developed internally, by external acquisition, outsourcing/offshoring or through hybrid approaches.
It addresses all aspects from determining information security requirements, to protecting information accessed by an application as well as preventing unauthorized use and/or actions of an application.
The standard is SDLC-method-agnostic: it does not mandate one or more specific development methods, approaches or stages but is written in a general manner to be applicable to them all. In this way, it complements other systems development standards and methods without conflicting with them.
ISO/IEC 27034-1:2011 — Information technology — Security techniques — Application security — Overview and concepts
-
As with other multipartite ISO27k standards, the first part sets the scene for the remainder, providing a general introduction and outlining the remaining parts;
-
~80 pages long with quite a bit of detail;
-
States explicitly that this is not a software application development standard, an application project management standard, nor a software development cycle standard. Its purpose is to provide general guidance that will be supported, in turn, by more detailed methods and standards in those areas;
-
Explicitly takes a process approach to specifying, designing, developing, testing, implementing and maintaining security functions and controls in application systems. For instance it defines application security not as the state of security of an application system but as “a process an organization can perform for applying controls and measurements to its applications in order the manage the risk of using them”;
-
Uses the concept of defining a Targeted Level of Trust (similar to a security plan) for an application, designing and building the application to meet it, and then validating the application against it;
-
Draws on concepts such as auditing and certification of application systems similar in style to the Common Criteria and similar schemes primarily used for government and military systems. The text tends to emphasize deliberate threats arising from external adversaries implying the importance of confidentiality controls, arguably downplaying insider and accidental threats and the need for integrity and availability controls, but the process described ostensibly takes account of the full spectrum of security risks and controls.
-
Status: part 1 was published in 2011 and is available for CHF172 from the ISO/IEC webstore.
ISO/IEC 27034-2 - Organization normative framework (draft)
-
Working drafts are available to members of SC27;
-
Explains the relationships and interdependencies between processes in the Organization Normative Framework (ONF);
-
Status: work in progress. 4th WD available to SC27.
ISO/IEC 27034-3 - Application security management process (pre-draft)
-
No text available as yet;
-
Part 1 says Part 3 will describe the [information security relevant] processes in an application development project, plus their relationships and interdependencies;
-
It sounds like this will be the most broadly applicable and useful part of this standard.
ISO/IEC 27034-4 - Application security validation (pre-draft)
-
No text available as yet;
-
Part 1 says Part 4 will describe an application security validation and certification process to assess and compare the ‘level of trust’ of an application system against its previously stated [information security] requirements.
ISO/IEC 27034-5 - Protocols and application security control data structure (draft)
-
-
The purpose of part 5 is to facilitate the implementation of the ISO/IEC 27034 application security framework and the communication and exchange of ASCs by defining a formal structure for ASCs and certain other components of the framework. It will enable the establishment of libraries of reusable application security functions that may be shared both within and between organizations;
-
Status: 1st WD available to SC27.
ISO/IEC 27034-6 - Security guidance for specific applications (draft)
All parts of the standard should with JTC1/SC17’s standards on software engineering, and the terminology used should align with ISO 31000. Hopefully.
|
