ISO/IEC 27034-3：2018 应用安全管理过程详解

版权申诉

5星 · 超过95%的资源 39 浏览量更新于2024-07-18 收藏 28.62MB PDF 举报

ISO IEC 27034-3是国际标准化组织和国际电工委员会联合发布的一项关于信息技术应用安全的重要标准，其第一版于2018年5月发布。该标准专注于“信息科技-应用安全-第3部分：应用安全管理过程”，旨在提供一套全面的应用安全管理流程指南。它旨在帮助企业、组织和个人确保在信息技术环境中开发、部署和维护应用程序时，能够有效地管理和控制潜在的安全风险。标准的主要内容包括以下几个方面： 1. 引言：对ISO IEC 27034-3的背景和目的进行了概述，强调了在数字化转型时代，保护应用程序安全的重要性。 2. 范围：描述了本标准适用的范围，可能涵盖各种类型的组织，无论规模大小，以及各类应用软件，从简单的Web应用到复杂的云计算环境。 3. 规范性引用：提供了相关的技术、管理和其他国际标准，作为本标准的基础，确保应用安全管理的连贯性和一致性。 4. 术语和定义：对关键概念进行明确，如“应用安全”、“信任级别”等，确保所有参与者对术语的理解一致。 5. 缩写词：列出在文档中使用的专业缩写，方便读者快速理解和查找相关信息。 6. 应用安全管理过程 (ASMP): - 5.1 非常重视一般原则，强调ASMP应适应组织的整体信息安全策略。 - 5.2 明确ASMP的目的，即为了确保应用程序在整个生命周期内的安全，包括规划、设计、开发、测试和维护阶段。 - 5.3.1 到5.3.8 展示了一系列核心原则，如明确角色和责任分配、与组织规范框架的整合、使用经过验证的工具、评估信任等级等，这些都是确保应用安全的关键步骤。 7. ASMP步骤： - 6.1 描述了识别应用程序需求和环境的过程，包括确定目标和风险，以便为安全措施提供基础。 - 6.1.1 详细解释了这个步骤的通用方法，涉及理解业务需求和预期功能。 - 6.1.2 强调了此阶段在整体ASMP中的作用，即为后续的安全设计、开发和审计提供坚实的基础。 ISO IEC 27034-3对于组织来说是一份实用的参考文档，通过遵循其指导，可以建立一个系统化的、可衡量的框架来提升应用程序的安全性，降低风险，并确保合规性。实施过程中，组织需根据自身的实际情况灵活调整，持续改进，以应对不断变化的威胁和挑战。

ISO/IEC

27034-3:2018(E)

Note 2 to entry: For an application, a

security

activity

and

its associated verification-measurement activity may

part

ASC.

3.3

critical information

information

which, if compromised,

can

result

unacceptable

risk

3.4

domain

expert

person

who

expert

in a

particular

domain,

area

topic

3.5

risk

management

coordinated

activities

direct

and

control

organization

with

regard

risk

Note 1 to entry: This document uses

the

term

"process" to describe risk management overall. The elements

within

the

risk

management process

are

termed

"activities".

[SOURCE:

ISO

Guide 73:2009,

2.1]

4 Abbreviated

terms

Application Security

ASC

Application Security Control

ASMP

Application Security Management Process

ANF

Application Normative

Framework

ASLCRM

Application Life Cycle

Security

Reference Model

ONF

Organization Normative

Framework

5 Application Security Management Process

5.1 General

The Application

Security

Management Process

(ASMP)

the

overall process for

managing

security

each specific application

used

developed

organization.

The

ONF

Committee is responsible for implementing

and

maintaining

the

ASMP

use

the

ONF

management

process (see ISO/IEC 27034-2:2015, 5.4.3). This

committee

is also responsible for

ensuring

that

the

ASMP

is applied

all application

projects

the

organization.

The Application

owner

is accountable for

ensuring

ASMP

is in place for

the

application

project

(see Table 3).

For each application project,

the

project

manager

is responsible for implementing

and

using

the

ASMP

the

course

the

project

(see Table 3).

The Application

Security

Management Process is

performed

in five steps:

identifying

the

application

requirements

and

environment;

assessing

application

security

risks;

creating

and

maintaining

the

Application Normative Framework;

d) provisioning

and

operating

the

application;

2 ©

ISO

/IEC

2018

All

rights

reserved

poorest

1S0/IEC

27034-3:2018(E)

auditing

the

security

the

application.

The

first

steps

the

ASMP

are

focused on identifying

and

recording

appropriate

application

security

controls

(ASCs)

for

application. Considering

that

security

front

is a

fundamental

aspect

application security,

the

optimal

point

to define

security

requirements

for a

software

project

during

the

initial

planning

stages. This

early

definition of

requirements

allows

project

teams

to identify key

milestones

and

deliverables,

and

permits

the

integration

security

in a

way

that

minimizes

any

disruption

plans

and

schedules.

The

last

steps

the

ASMP

are

focused on implementation

and

verification of

ASCs.

ISO/IEC 27034 (all

parts)

provides components,

processes

and

frameworks

that

help

organization

acquire, implement

and

use

applications it

can

trust,

acceptable

security

cost

determined

the

organization. Moreover specifically,

these

components,

processes

and

frameworks

provide

demonstrable

evidence

that

applications reach

and

maintain

targeted

level of

trust.

shown

in Figure

these

components,

processes

and

frameworks

are

part

two

overall processes:

the

ONF

Management Process;

the

Application

Security

Management Process

(ASMP).

Key

r------

...

I I

______

group

element

Application Security Management

Process

Assessing

the

application

security

risks

Identifies

Application

context

and

specifications

used for

Identifying

the

application

requirements

and

environment

Determines-f

/·

···~---.. \ __

_Is

used

\ •

••

•.•

••

.••

••

. / for

Application's

Targeted

Level

Trust

~ /

Provides

Appli

;~l:iOii

'~-~ctual

Auditing

the

security

the

application

Provides

Level

Trust

Mandates

security

adjustments

for

Implemented

required

ASCs

----

used for

Provides

Creating

and

maintaining

the

Application

Normative

Framework

Provides

Application Normative

Framework

used

for

Realizing

and

rating

the

application

~\,

------"PPlication

project

art

efacts

----

.........

___________

an_d_AN_F_u_,

_ct_ro_r

_______________

•

•••

[

/ ,

...

~:~;:~:

••

.,,

••••

••

...

,oc~,

.~.~;~

...... ]

for

\ I

····-----------------------------···

process

action

Figure 1 -

Application

Security

Management

Process

2018

-All

rights

reserved

poorest

ISO/IEC

27034-3:2018(E)

These

two

processes

are

used

different levels

and

time

frames in

the

organization

and

have different

scopes. The

ONF

Management Process (see ISO/IEC 27034-2) is a continuous organizational-level

process

and

the

ASMP

used

for

managing

security

on each specific application project.

5.2 Purpose

The Application

Security

Management Process allows

organization

manage

security

for each

application it uses.

5.3 Principles and concepts

5.3.1 General

In addition to principles

introduced

in ISO/IEC 27034-1,

organizations

creating,

operating

maintaining

applications should

guided

the

following principles:

every

application should

assigned a Targeted Level of Trust;

any

security

component

process

used

application

project

should

selected

from

the

ONF;

all

ASCs

selected

with

the

Targeted Level of

Trust

should

implemented, verified

and

audited.

5.3.2 Clearly communicate

roles

and

responsibilities

This

document

uses

RAC!

charts

for assigning roles

and

responsibilities for

carrying

out

activities

in processes. Such

charts

identify

actors

responsible, accountable,

consulted

informed

for

the

realization of

activity. Abbreviations

are

used

for describing responsibilities of actors. Those

are

enumerated

in Table 2.

Table 2 - Abbreviations for

responsibilities

used

RACI

charts

Code

Responsibility

Responsible for

the

realization

activity

A Accountable for

the

realization

activity

C Consulted

during

the

realization

activity

I Informed

the

realization

activity

Use of

RAC!

charts

within

organization implementing

this

document

not

required.

Organizations

should align guidance provided in

this

document

with

their

own

method

of clarifying roles

and

responsibilities.

When

conducting realization

and

verification activities, it is critical for

organizations

determine

the

resources

that

are

responsible, accountable, consulted,

and

are

informed. Table 2 provides a

starting

point

for discussion

during

the

realization of

ANF.

5.3.3 Relationship

the

ASMP

with

the

Organizational Normative Framework

(ONF)

The

ONF,

which is covered in detail in ISO/IEC 27034-2, provides

organization-level

context

for

the

ASMP.

This

context

includes all

processes

involved in application security, as well as regulations, laws,

best

practices, roles,

and

responsibilities accepted

the

organization. The

ASMP

uses

this

context

create

and

maintain

the

Application Normative

Framework

(ANF) for each application project. In

return,

the

ASMP

supports

continual

improvement

the

ONF

through

feedback of

new

knowledge,

application

security

control

improvement

suggestions

and

practices

gained

the

course

application's development

and

deployment.

4 ©

ISO

/IEC

2018

All

rights

reserved

poorest

剩余55页未读，继续阅读

alarmano

粉丝: 26
资源: 1万+

ISO/IEC 27034-3：2018 应用安全管理过程详解

ISO_IEC27034-2-2015

ISO IEC 20000-3-2019中文-信息技术-服务管理-第3部分：ISO IEC 20000-1的范围定义和适用性指南

ISO IEC 27034-6

ISO IEC 27034-5

ISO IEC 27034-2

ISO IEC 27034-1

ISO/IEC 27034-2 Draft

ISO IEC 27034-5：2017：应用安全协议与数据结构详解

ISO/IEC 27034-1：应用安全概述与概念

ISO IEC 20000-3-2019 信息技术-服务管理-第3部分：ISO IEC 20000-1的范围定义和适用性指南.

最新资源