Policy
Software developed and maintained must be free of vulnerabilities that may be exploited by threats such as hackers and hacking software.
Developers and testers should be made aware of rules that govern development of secure software in the organization. This is achieved by
- Adopting secure development practices
- Penetration and Vulnerability testing
- Restricting source code
For development and maintenance of software, adopt standard application development guidelines.
Developer access to source code is controlled and is need based.
Software developed shall be tested for vulnerability.
Security requirements analysis and specification
Software applications that are developed in Redisolve will follow the security measures during development to ensure the Confidentiality, Integrity and Availability of information are protected during information processing by the applications.
Requirements given by the customers / users are used as a specification for developing the software; the requirements for security in applications are adopted as per details given by customers / users. The requirements are captured through software requirements specifications, change request, email.
The requirements are analyzed and translated into design and code. The evidence of the security design or code and subsequent reviews are maintained
The applications that are developed follow Application Development security guidelines.
Software development team / IT Team maintains the list of software applications developed and maintained by the organization.
Testing
Manual and User Acceptance Testing are conducted while adopting a new information application or a major version/feature of the application is released.
For existing applications/systems that has minor enhancements only system testing is carried out. Separate staging and test environments are maintained to test the applications
The test case includes scenarios related to both quality and security
Test results are tracked in excel files
Deployment
Specific roles shall be defined for deployment in development/staging/production server.
Manager Approvals are needed for movement of changes into production servers.
Access control to program source code
The access to program source code and other configuration items (such as design document, specification, test plans and scenarios along with execution results) are strictly controlled to prevent unintentional/unauthorized changes to source code.
The source code is maintained in server with appropriate privileges to add/modify/delete for the users.
Monthly access logs are maintained periodically that records the activities of users such as addition/modification/deletion of source code
Access control to Development and Production Environments
The access to development and production environments is restricted.
The list of authorized users for each environment is maintained by the respective owners. The control of movement of data from and to the environment is based on the requests raised