In this introduction to ISO 27001 Application Security Requirements you will learn
- What Application Security Requirements are
- Introductory compliance guidance
I am Stuart Barker and this is ISO 27001 Application Security Requirements Explained Simply.
Table of contents
Application Security Requirements
Application Security Requirements emphasises the importance of integrating security considerations throughout the entire application lifecycle, adhering to the principle of “security by design and default.”
Security by design and default is not a new concept but is new to 27001.
This control requires organisations to clearly define the specific information security requirements for all applications and then ensure that all security requirements are formally approved before development or acquisition takes place.
The hope is that by proactively incorporating security requirements into the application development process, organisations can significantly enhance the security and resilience of their applications.
Who owns it?
The Chief Information Security Officer (CISO), supported by information security specialists, is responsible for identifying, approving, and implementing information security requirements for the acquisition, use, and development of applications.
Compliance Guidance
The following is compliance guidance for Application Security Requirements.
Identifying and Specifying Application Security Requirements
Foundation
- Application security requirements must be clearly identified and specified.
- A thorough risk assessment is crucial for determining these requirements.
- Information security specialists should be actively involved in this process.
Scope
Security requirements should encompass a wide range of aspects, depending on the application’s purpose and criticality.
Key Considerations:
Authentication and Authorisation:
- Define and implement robust authentication and authorisation mechanisms.
- Determine the appropriate level of trust in user identities.
Data Protection:
- Classify data based on sensitivity and implement appropriate protection measures (e.g., encryption, access controls).
- Ensure data confidentiality, integrity, and availability throughout the application lifecycle.
Vulnerability Mitigation:
- Address potential vulnerabilities such as SQL injection, cross-site scripting, and buffer overflows.
- Ensure compliance with all relevant laws and regulations.
Privacy:
Address the privacy concerns of all parties involved.
Technical Considerations:
- Implement input validation, data sanitisation, and secure output controls.
- Utilise automated controls such as approval limits, dual approvals, and intrusion detection systems.
- Implement robust logging and monitoring capabilities to detect and respond to security incidents.
Business Process Considerations:
Align security requirements with specific business needs and processes.
Incorporate requirements for transaction logging, monitoring, and non-repudiation.
External Factors:
Consider legal and regulatory requirements, industry best practices, and the security requirements of other relevant controls (e.g., logging, monitoring, and data leakage prevention).
Transactional Services
When developing applications that facilitate transactions between the organisation and external partners, the following security requirements should be carefully considered:
Identity and Trust
Establish and maintain appropriate levels of trust in the claimed identities of both parties involved in the transaction.
Data Integrity
Ensure the integrity of all information exchanged or processed during the transaction.
Implement mechanisms to detect and prevent data corruption or tampering (e.g., cyclic redundancy checks, hashing, digital signatures).
Authorisation and Approval
Define and implement clear authorisation processes for approving the content, issuance, and signing of key transactional documents.
Data Confidentiality
Maintain the confidentiality of sensitive transactional information, such as order details, delivery addresses, and payment information.
Non-Repudiation
Implement mechanisms to ensure non-repudiation of transactions, such as proof of dispatch and receipt of key documents.
Data Retention
Determine and implement appropriate data retention policies for confidential transactional information.
Ensure compliance with all relevant legal, regulatory, and contractual obligations, including insurance requirements.
Electronic Ordering and Payment Applications
When developing applications that involve electronic ordering and payment, the following must be addressed:
Order Information Security
Maintain the confidentiality and integrity of all order information.
Payment Information Verification
Implement appropriate verification procedures to ensure the accuracy and authenticity of customer-supplied payment information.
Transaction Integrity
Prevent the loss or duplication of transaction information.
Secure Data Storage
Store transaction details in secure, non-publicly accessible environments (e.g., on the organisational intranet).
Trusted Authority Integration
If a trusted authority is used (e.g., for digital certificates), ensure that security is integrated throughout the entire certificate or signature management process.
Cryptography
Utilise cryptographic techniques (see 8.24) to protect data confidentiality, integrity, and authenticity.
Legal and Regulatory Compliance
Adhere to all relevant legal and regulatory requirements related to electronic transactions and data protection.
Supplementary Guidance
Network-accessible applications face unique security challenges, including fraudulent activities, contract disputes, data breaches, and transmission errors (e.g., incomplete transmission, misrouting, unauthorised message alteration, duplication, or replay).
Thorough risk assessments and careful selection of controls are essential to mitigate these risks.
Cryptographic methods are often crucial for authentication and secure data transfer. Further guidance on application security can be found in the ISO/IEC 27034 series.
ISO 27001 Secure Development Policy Template
The following is a fully ISO 27001 compliant ISO 27001 Secure Development Policy Template.
Further Reading
ISO 27001 Annex A 8.26 Application Security Requirements specifically addresses the requirements of application security.
