NIST SP800-64修订2：系统开发生命周期中的安全活动

需积分: 9 143 浏览量更新于2024-07-16 收藏 932KB PDF 举报

"NIST SP800-64-Revision2.pdf" 是一份由美国国家标准与技术研究所（NIST）发布的关于系统开发生命周期（SDLC）中的安全考虑的指南，旨在帮助机构在信息技术（IT）开发过程中融入安全性，从而实现更经济、风险适中的安全控制识别、开发和测试。该指南主要关注SDLC中的信息安全组件，不涉及整体系统实施和发展，也不涵盖组织的信息系统治理过程。 NIST SP800-64第二版详细阐述了在大多数信息系统开发中所需的关键安全角色和责任。它还提供关于SDLC的足够信息，使对SDLC流程不熟悉的人能理解信息安全与SDLC之间的关系。文档范围限定在瀑布模型的SDLC方法中发生的安全活动，但预期这些原则可以应用于任何其他机构可能采用的SDLC方法。本指南的核心知识点包括： 1. **安全角色和责任**：在系统开发中，明确并理解关键的安全角色至关重要，如安全架构师、安全分析师、项目经理、开发人员等，他们的职责涵盖了从需求分析到系统维护的各个阶段，确保安全控制的集成。 2. **系统开发生命周期**（SDLC）：SDLC是软件开发的过程，包括需求收集、设计、编码、测试和维护等阶段。NIST SP800-64强调了在每个阶段如何嵌入安全实践，以确保安全不是事后诸葛亮，而是从一开始就融入整个流程。 3. **安全活动**：在瀑布模型中，安全活动可能包括威胁建模、风险评估、安全设计审查、代码审核、安全测试和验证。这些活动应在SDLC的每个阶段都得到适当的执行，以降低潜在的安全风险。 4. **跨方法论适用性**：虽然指南以瀑布模型为例，但其核心理念和推荐做法可以适应敏捷、迭代或混合的开发模型，强调了安全实践的灵活性和可移植性。 5. **标准与指南**：NIST作为美国的技术领导者，其发布的报告和标准对于行业具有指导意义，ITL负责制定管理、行政、技术和物理层面的标准和指南，以促进信息科技的安全、有效利用。 6. **风险管理**：在SDLC中，风险管理是核心组成部分，包括识别、评估、缓解和监控风险，确保所实施的安全控制能够有效地应对潜在威胁。 7. **合规性**：NIST SP800系列标准通常与联邦政府的法规和合规要求相关，但其原则也适用于私营部门，帮助组织满足ISO、COBIT等国际标准和最佳实践。通过遵循NIST SP800-64的建议，组织能够建立一套更为健壮的SDLC框架，将安全考虑深入到每一个开发环节，从而提高系统的安全性和可靠性。

• Initiation. During the initiation phase, the need for a system is expressed and the purpose of

the system is documented.

• Development/Acquisition. During this phase, the system is designed, purchased,

programmed, developed, or otherwise constructed.

• Implementation/Assessment. After system acceptance testing, the system is installed or

fielded.

• Operation/Maintenance. During this phase, the system performs its work. The system is

almost always modified by the addition of hardware and software and by numerous other

events.

• Disposal. Activities conducted during this phase ensure the orderly termination of the system,

safeguarding vital system information, and migrating data processed by the system to a

new system, or preserving it in accordance with applicable records management regulations

and policies.

The SDLC guideline provides utility by documenting:

• insight into the major activities and milestones;

• decision points or control gates;

• specified outputs that provide vital information into system design;

• project accomplishments; and

• system maintenance, security, and operational considerations.

The guideline should support, and be supported by, the agency’s mission processes, enterprise

architecture, and financial processes.

2.1.2 Introduction to Security Integration

Executing a risk management-based approach for systems and projects means integrating

security into the agency’s established system development and CPIC life cycles. An integrated

security component (composed of milestones, deliverables, control gates, and interdependencies)

that specifically addresses risk management (discussed in the next section) enables security to be

planned, acquired, built in, and deployed as an integral part of a project or system. It also plays a

significant role in measuring and enforcing security requirements throughout the life cycle. Full

and effective integration within the SDLC enables information security professionals, partnered

with CPIC, IT and EA representatives, to promote effective management and oversight of

security considerations throughout the life cycle.

Implementing information security early in the project allows the requirements to mature as

needed and in an integrated and cost-effective manner. Engineering security into a product’s

initiation phase typically costs less than acquiring technologies later that may need to be

reconfigured, customized or may provide more or fewer security controls than required. Security

should be included during the requirements generation of any project. Designing a solution with

consideration for security could substantially reduce the need for additive security controls (e.g.,

designing a house with two doors versus four requires less point-of-entry security, and wiring the

house for a security system and electricity at the same time precludes tearing holes in the walls

later). This also allows for security planning at an enterprise level that allows reuse, decreases

cost and schedule development, and promotes security reliability.

Implementer’s Tip

Security activities should be physically and logically integrated into the agency’s SDLC policy

and guidelines versus maintaining them in a separate, complementary document or security life

cycle. This ensures a wider audience and decreases the need for the reader to reference multiple

documents unnecessarily. Of course, security integration can and should reference supplemental

process documents that provide further details.

The most effective way to accomplish the integration of security within the system development

life cycle is to plan and implement a comprehensive risk management program (see section

2.1.5). This results in integrated security costs and requirements as well as an embedded,

repeated authorization process that provides risk information to IT stakeholders and developers

throughout the agency.

2.1.3 Capital Planning & Investment Control Process

Each agency has an established and documented CPIC process in line with OMB Circular A-11.

NIST SP 800-65, Integrating IT Security into the Capital Planning and Investment Control

Process, further articulates the integration and value of security. This guideline seeks to continue

this discussion with a focus on security integration within the SDLC.

Key concepts from NIST SP 800-65 that should be considered when reading this guideline

include:

• The CPIC process is defined by OMB Circular A-130 as “a management process for ongoing

identification, selection, control, and evaluation of investments in information resources.

The process links budget formulation and execution, and is focused on agency missions

and achieving specific program outcomes.” Integrating security into this process ensures

that information resources are planned and provided in a thorough, disciplined manner,

enabling improved security for IT investments.

• Integrating security into the CPIC process consists of a seven-step methodology to ensure

that mission and security requirements are met throughout the investment life cycle.

• While specific roles and responsibilities will vary from agency to agency, involvement at the

enterprise and operating unit levels throughout the process allows agencies to ensure that

capital planning and information security goals and objectives are met.

• In concert with the OMB capital planning and NIST guidelines, agencies are required to

adhere to the Government Accountability Office’s (GAO) best practices, three-phase

investment life-cycle model for federal IT investments.

• Costs associated with implementing and assessing information security controls and ensuring

effective protection of federal IT resources should be accounted for in the capital planning

process.

2.1.4 Security Architectures

Security architectures should be in line with NIST guidelines consisting of security control

families outlined in NIST SP 800-53 with regard to protecting the confidentiality, integrity, and

availability of federal information and information systems. A comprehensive security

architecture acknowledges current security services, tools and expertise, outlines forecasted

business needs and requirements, and clearly articulates an implementation plan aligned with the

agency’s culture and strategic plans. Usually, the security architecture is supplemented with an

integrated schedule of tasks that identifies expected outcomes (indications and triggers for

further review/alignment), establishes project timelines, provides estimates of resource

requirements, and identifies key project dependencies.

2.1.5 Role in the NIST Risk Management Framework

NIST SP 800-64 complements the Risk Management Framework by providing a sample

roadmap for integrating security functionality and assurance into the SDLC. In addition, this

publication provides further detail on additional activities that are valuable for consideration

given that each system and agency culture varies. These additional activities supplement the risk

management framework. A more detailed description of the NIST Risk Management Framework

is presented in NIST Draft SP 800-39, Managing Risk from Information Systems: An

Organizational Perspective.

2.2 Legacy System Considerations

In many cases, organizations will be applying information security life cycle considerations to

legacy information systems that have been in operation for some extended period of time. Some

legacy systems may have excellent security plans that provide comprehensive documentation of

the risk management decisions that have been made, including identifying the security controls

currently employed. Other legacy systems may have limited documentation available. The

security considerations, however, are still relevant to these legacy systems, and should be applied

and documented to ensure security controls are in place and functioning effectively to provide

adequate protections for the information and the information system.

Implementer’s Tip

Effective communication of security requirements and expectations is a vital and challenging

step. The key is to document the security requirement in specific and measurable terms so that it

clearly identifies who has the responsibility and accountability. The medium (memorandum,

agreement, or expectation document) as well as the granularity and complexity should be

manageable and cost-effective. This is a topic discussed throughout this publication.

2.3 Key Roles and Responsibilities in the SDLC

Many participants have a role in information system development. The names for the roles and

titles will vary among organizations. Not every participant works on every activity within a

phase. The determination of which participants need to be consulted in each phase is as unique to

the organization as the development. With any development project, it is important to involve

appropriate information security personnel as early as possible, preferably in the initiation phase.

A list of key roles is provided below. In some organizations, a single individual may hold

multiple roles.

剩余66页未读，继续阅读

艾米的爸爸

粉丝: 800
资源: 314

NIST SP800-64修订2：系统开发生命周期中的安全活动

NIST SP 800-193(中文)

ANSI-INCITS-424-2007(FC-FS-2)

NIST-SP-800-64.docx

nist sp800-161下载

NIST SP800-90A

nist sp800-181

nist sp800-108

NIST SP800-131A

如何根据NIST SP800-82标准评估工业控制系统(ICS)的安全性？

nist sp800-60

最新资源