High Level Requirements Categories - Revision history

Andylew: /* Additional Security Considerations */

2011-02-26T08:35:47Z

‎Additional Security Considerations

Andylew: /* Additional Security Considerations */

2011-02-26T08:35:10Z

‎Additional Security Considerations

Andylew: /* Logging */

2011-02-26T08:33:07Z

‎Logging

Andylew: /* Application */

2011-02-26T08:30:26Z

‎Application

Andylew: Cleaned up and resequenced the first stab a little.

2011-02-26T08:29:28Z

Cleaned up and resequenced the first stab a little.

Andylew: This is more of a framework of requirements for an overall project than pure Development requirements. Definitely needs work and code-specific requirements should probably be split out from overall r

2011-02-26T07:10:18Z

This is more of a framework of requirements for an overall project than pure Development requirements. Definitely needs work and code-specific requirements should probably be split out from overall r

New page

==Intro==
==Categories of Requirements==
===Compliance===
====PCI DSS====
=====Current requirements=====
=====OWASP Top 10=====
=====WAF Integration considerations=====
=====Ongoing testing considerations=====
====GLBA====
=====Ain't it embarrassing that you do banking on-line but have NO IDEA what standards your bank is supposed to adhere to for safekeeping of YOUR money=====
======Go ahead, list some requirements======
====HIPAA====
====Basel II====
====National Compliance Requirements====
=====Privacy Policy=====
=====Log retention=====
=====Content archiving and retention=====
=====Protection of minors=====
====State/Province Compliance Requirements====
====Municipality Compliance Requirments====
====Compliance with existing contracts and business obligations====
===Auditability===
====Logging====
=====Application=====
=====OS, Webserver, and Database Logging=====
=====Firewall, WAF, and other security device logging=====
====Event Triggers====
=====Periodic log reviews=====
=====Event-driven log analysis=====
======Employee termination=======
======Suspected breach======
======Honeypot trigger======
===Application Security===
====NO PASSWORDS EMBEDDED IN CODE! REALLY!====
====Input validation====
=====Whitelisting when possible=====
=====Blacklisting by exception=====
=====Escaping output=====
====Session controls====
====Anti-trojan design considerations====
=====Email/SMS/telephone confirmation=====
=====2-factor authentication=====
=====Transfer timing controls=====
=====Number of simultaneous sessions permitted=====
=====Detection of simultaneous sessions from different continents=====
====Authentication considerations====
=====Application=====
======See [[File:OWASP_Application_Security_Requirements_-_Identification_and_Authorisation_v0.1_(DRAFT).doc]]======
=====Management and administration tools=====
======2-Factor Authentication======

====Anti-fraud and business logic flaw considerations====
===Additional Security Considerations===

====Decoys, Honeypots, and other devices for detection and delay====
====Network, Hardware, Physical, OS, Platform, and Framework Considerations====
=====Network Security Considerations=====
=====Hardware Security Considerations=====
=====Physical Security Considerations=====
=====OS Security Considerations=====
======Hardening standards======
====Platform Security Considerations====
=====Hardening standards=====
=====Configuration management and auditing=====
=====Patching=====
=====Minimized attack surface=====
=====Removal of all demo code======
=====Changing of all default passwords=====
=====Robots.txt and passive crawler considerations=====
====Operational Security Considerations====
======Clean desk policy======
======Bonding of outsourced/off-shored Developers======
======Need to know======
======Trade secrets======
======Posting questions to help, support, and user forums======
======Customer Service Identification and Authenticaion considerations======
=======Distinguishing a legitimate user from a social-engineering scam-artist=======
===Encryption Requirements===
====Encryption of Data at rest====
====Encryption of Data in transit====
====Encryption of Data while processing====
====Encryption and obfuscation of code====
====Hash functions====
=====Code signing=====
=====Message Digests=====
====Whatever Bruce Schneier says====
====Encryption of Remote Administration and Content Management tools====

@@ Line 71: / Line 71: @@
 ===Additional Security Considerations===
-Steps shall be taken to ensure that support staff are aware of attempted compromise, tampering, fraud, physical theft, of denial of service.
+Steps shall be taken to ensure that support staff reduce the likelihood and are aware of attempted compromise, tampering, fraud, physical theft, of denial of service.
 #Decoys, Honeypots, and other devices for detection and delay
 #Network, Hardware, Physical, OS, Platform, and Framework Considerations

@@ Line 71: / Line 71: @@
 ===Additional Security Considerations===
 #Decoys, Honeypots, and other devices for detection and delay
 #Network, Hardware, Physical, OS, Platform, and Framework Considerations

@@ Line 59: / Line 59: @@
 ===Auditability===
 ====Logging====
 #Application
 #OS, Webserver, and Database Logging
@@ Line 68: / Line 69: @@
 ###Suspected breach
 ###Honeypot trigger
 ===Additional Security Considerations===

@@ Line 21: / Line 21: @@
 ====Authentication considerations====
 =====Application=====
-#See [[File:OWASP_Application_Security_Requirements_-_Identification_and_Authorisation_v0.1_(DRAFT).doc]]======
+#See [[File:OWASP_Application_Security_Requirements_-_Identification_and_Authorisation_v0.1_(DRAFT).doc]]
 =====Management and administration tools=====
 #2-Factor Authentication

@@ Line 1: / Line 1: @@
 ==Intro==
 ==Categories of Requirements==
 ===Compliance===
 ====PCI DSS====
-=====Current requirements=====
+#Current requirements
-=====OWASP Top 10=====
+#[http://www.owasp.org/index.php/Top_10 OWASP Top 10]
-=====WAF Integration considerations=====
+#WAF Integration considerations
-=====Ongoing testing considerations=====
+#Ongoing testing considerations
 ====GLBA====
-=====Ain't it embarrassing that you do banking on-line but have NO IDEA what standards your bank is supposed to adhere to for safekeeping of YOUR money=====
+#Ain't it embarrassing that you do banking on-line but have NO IDEA what standards your bank is supposed to adhere to for safekeeping of YOUR money?!?
-======Go ahead, list some requirements======
+#Go ahead, list some requirements
 ====HIPAA====
 ====Basel II====
 ====National Compliance Requirements====
-=====Privacy Policy=====
+#Privacy Policy
-=====Log retention=====
+#Logging and log retention
-=====Content archiving and retention=====
+#Content archiving and retention
-=====Protection of minors=====
+#Protection of minors
 ====State/Province Compliance Requirements====
 ====Municipality Compliance Requirments====
@@ Line 22: / Line 58: @@
 ===Auditability===
 ====Logging====
-=====Application=====
+#Application
-=====OS, Webserver, and Database Logging=====
+#OS, Webserver, and Database Logging
-=====Firewall, WAF, and other security device logging=====
+#Firewall, WAF, and other security device logging
-====Event Triggers====
+#Event Triggers
-=====Periodic log reviews=====
+##Periodic log reviews
-=====Event-driven log analysis=====
+##Event-driven log analysis
-======Employee termination=======
+###Employee termination
-======Suspected breach======
+###Suspected breach
-======Honeypot trigger======
+###Honeypot trigger
-===Application Security===
 ===Additional Security Considerations===
 ====Operational Security Considerations====
-======Clean desk policy======
+#Clean desk policy
-======Bonding of outsourced/off-shored Developers======
+#Bonding of outsourced/off-shored Developers
-======Need to know======
+#Need to know
-======Trade secrets======
+#Trade secrets
-======Posting questions to help, support, and user forums======
+#Posting questions to help, support, and user forums
-======Customer Service Identification and Authenticaion considerations======
+#Customer Service Identification and Authenticaion considerations
-=======Distinguishing a legitimate user from a social-engineering scam-artist=======
+##Distinguishing a legitimate user from a social-engineering scam-artist