Security, Data and Assurance
Overview
Security, data protection and assurance must be built into delivery from the beginning. They are not final-stage activities.
Security by Phase
Discovery
Focus on identifying security, data and assurance constraints.
Activities:
identify data types
identify likely access requirements
identify customer security policies
identify hosting and integration constraints
identify assurance obligations
Alpha
Focus on testing security assumptions.
Activities:
explore data flow options
assess integration risks
identify threat areas
test feasibility of secure approaches
avoid unnecessary real sensitive data
Beta
Focus on implementing secure controls and producing evidence.
Activities:
secure coding
code review
dependency scanning
vulnerability management
access control implementation
test evidence
security review
Live
Focus on monitoring, patching, incident response and continuous assurance.
Activities:
vulnerability monitoring
access review
incident management
logging and monitoring
backup and recovery review
security reporting
Retirement
Focus on secure closure.
Activities:
access removal
data deletion or retention
archive protection
integration closure
credential removal
decommissioning evidence
Data Classification
Projects should classify data before handling it.
Possible classifications:
public
internal
confidential
customer confidential
personal data
sensitive operational data
special category personal data where applicable
Access Control
Access should follow:
least privilege
named accounts
multi-factor authentication where required
role-based access
time-bound access
regular review
prompt removal
Assurance Evidence
Assurance evidence may include:
security requirements
architecture decision records
data flow maps
access control matrix
vulnerability scan results
penetration test reports where applicable
remediation records
risk acceptance records
release approvals
operational readiness checklist
Security Risk Acceptance
Security risks must not be accepted informally.
A risk acceptance should record:
risk description
impact
likelihood
mitigation
residual risk
accepting authority
review date
expiry or condition
Minimum Security Questions
Every project should ask:
What data will we handle?
Who needs access?
Where will data be stored?
How will data move between systems?
What logging is required?
What security controls are mandatory?
What evidence will the customer need?
What happens if there is an incident?
Last updated
Was this helpful?

