The selection of procured software for deployment on higher priority assets includes consideration of the vendor’s secure software development practices

The organization may enforce secure software development practices with vendors through various means such as contractual requirements and technical testing of vendor code. The organization may specify secure design and coding practices from vendors such as those identified in established standards including the NIST Secure Software Development Framework (SSDF), Building Security In Maturity Model (BSIMM), and Open Web Application Security Project (OWASP). This can be done by observing the behavior of the application and inferring the vendor’s coding practices, or by running some tests to uncover insecure practices such as buffer overflow, SQL injection, and poor authentication. Beyond that, the cybersecurity architecture can facilitate the integration and interoperability of procured system components (for example, by providing secure interfaces to third-party software). Additional consideration should be given to high priority suppliers (THIRD-PARTIES-1c) because they supply, maintain, or operate critical software components that are essential to the operation of the function. The definition of a critical software component may vary widely depending on industry or critical infrastructure sector, and may be informed by commonly-used frameworks or control sets. For example NIST provides a definition of critical software under Executive Order 14028 that some organizations may be required to adopt. This activity is related to the cybersecurity architecture activities associated with selecting vendors based on their secure software development practices (THIRD-PARTIES-2h and ARCHITECTURE-4e).

Related Practices · Input From: Implementing ASSET-1c provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ARCHITECTURE-4b, ARCHITECTURE-4e, ARCHITECTURE-4g, ARCHITECTURE-4h, ARCHITECTURE-5h.