Security Touchpoints When Acquiring Soft...
summary
Maps concrete security checks to acquisition phases: planning requires threat-driven requirements using the SQUARE requirements method and an assurance case; contracting must include contractual SLA for patches and explicit deliverables plus an OWASP-style annex; monitoring and acceptance demand static and dynamic analysis with periodic test reports and measurable acceptance criteria; for COTS negotiate either third-party code review or supplier-shared review results and insist on vendor timeliness, support for fixes, and source‑access or verifiable evidence that testing actually happened.
AI-written summary · about
chapters (15)
- 0:00Start
- 3:23Context Today's Landscape of SW Development & Acquisition
- 4:28Defining the Problem
- 5:19How does security factor into the acquisition process?
- 13:27Identify Security Category
- 14:58Develop Security Requirements
- 17:24Identify Software Alternatives
- 18:00Create Acquisition Plan
- 18:59Request For Proposal Considerations
- 20:56Due Diligence Questionnaires
- 24:01Example OWASP Secure Software Contract Annex
- 25:46Review and Accept Deliverables
- 29:23Maintain the Software
- 31:40Recap
- 33:15Conclusions
related talks
45mSecurity Architecture, An Adventure?
38mBuilding a Security Assurance Program
23mSecurity Doesn't Have To Be a Nightmare
57mShift Left Security with the Security Test Pyramid
44mA Walkthrough: AppSec Tool Selection, Procurement, and Implementation
44mSecurity Practices Useful in Agile Development
01h 04mShifting Security Everywhere
52mContinuous Security