IT 项目的安全需求（一）— CLASP

IT项目需求中的有一项重要的需求就是安全需求，怎样制定安全需求，我会分两篇文章介绍两种通用的安全需求框架

 第一种是CLASP

CLASP (Comprehensive, Lightweight Application Security Process) 提供一种组织良好的、结构化的方法，在软件开发生命周期的早期阶段进行安全需求的制定。

 

CLASP实际上是一组可以集成到任何软件开发过程中的项目活动。它被设计成既有效又容易采用。它提供了一些规定性的方法，活动，大量的安全资源，都可以是否有效的帮助我们在项目种开展这些活动。

 

下面这个表就是CLASP中描述的活动：

CLASP Best Practices

CLASP Activities

Related Project Roles

1. Institute awareness programs

Institute security awareness program

Project manager

2. Perform application assessments

Perform security analysis of system requirements and design (threat modeling)

Security auditor

Perform source-level security review

Owner: security auditor

Key contributor: implementer, designer

Identify, implement, and perform security tests

Test analyst

Verify security attributes of resources

Tester

Research and assess security posture of technology solutions

Owner: designer

Key contributor: component vendor

3. Capture security requirements

Identify global security policy

Requirements specifier

Identify resources and trust boundaries

Owner: architect

Key contributor: requirements specifier

Identify user roles and resource capabilities

Owner: architect

Key contributor: requirements specifier

Specify operational environment

Owner: requirements specifier

Key contributor: architect

Detail misuse cases

Owner: requirements specifier

Key contributor: stakeholder

Identify attack surface

Designer

Document security-relevant requirements

Owner: requirements specifier

Key contributor: architect

4. Implement secure development practices

Apply security principles to design

Designer

Annotate class designs with security properties

Designer

Implement and elaborate resource policies and security technologies

Implementer

Implement interface contracts

Implementer

Integrate security analysis into source management process

Integrator

Perform code signing

Integrator

5. Build vulnerability remediation procedures

Manage security issue disclosure process

Owner: project manager

Key contributor: designer

Address reported security issues

Owner: designer

Fault reporter

6. Define and monitor metrics

Monitor security metrics

Project manager

7. Publish operational security guidelines

Specify database security configuration

Database designer

Build operational security guide

Owner: integrator

Key contributor: designer, architect, implementer