Secure Software Development Framework (SSDF) Version 1.1

[wangleo61]

National Institute of Standards and Technology
NIST](https://www.nist.gov/)
[美国国家标准与技术研究院
推出的安全的软件开发框架
NIST
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04232020.pdf

https://www.synopsys.com/blogs/software-security/nist-ssdf-secure-software-development-framework/
NIST.CSWP.04232020.pdf

[wangleo61]

[wangleo61]

Verify Third-Party Software Complies with Security Requirements (PW.3): Reduce the risk associated with using acquired software modules and services, which are potential sources of additional vulnerabilities.
PW.3.2: Use appropriate means to verify that commercial, open source, and all other third-party software modules and services comply with the requirements
See if there are publicly known
vulnerabilities in the software modules
and services that the vendor has not yet
fixed.
• Ensure each software module or service is still actively maintained, which should include new vulnerabilities found in the
software being remediated.
• Determine a plan of action for each third�party software module or service that is no longer being maintained or available
in the future.
• Use the results of commercial services for vetting the software modules and services.
• [See Review and/or Analyze Human�Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements (PW.7)] • [See Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements (PW.8)]

BSA: SC.3-1, TV.2
IDASOAR: Fact Sheet 21
MSSDL: Practice 7
OWASPASVS: 10, 14.2
PCISSLRAP: 4.1
SCAGILE: Tasks Requiring the Help of
Security Experts 8
SCFPSSD
Inherent in the Use of Third
: Manage Security Risk -Party
Components
SCSIC: Vendor Sourcing Integrity Controls
SCTPC: 3.2.2
SP80053: SA-12
SP800160: 3.1.2, 3.3.8
SP800181: SP-DEV-002; K0153, K0266
[See Review and/or Analyze Human�Readable Code to Identify
Vulnerabilities and Verify Compliance
with Security Requirements (PW.7)]
[See Test Executable Code to Identify
Vulnerabilities and Verify Compliance
with Security Requirements (PW.8)]

[will-ww]

Thanks for your sharing~

[wangleo61]

It’s very interesting and deep dive 从 Windows 版邮件<https://go.microsoft.com/fwlink/?LinkId=550986>发送 发件人: Will ***@***.***> 发送时间: Tuesday, March 15, 2022 9:44 PM 收件人: ***@***.***> 抄送: ***@***.***>; ***@***.***> 主题: Re: [kaiyuanshe/ONES] Secure Software Development Framework (SSDF) Version 1.1 (Discussion #39) Thanks for your sharing~ ― Reply to this email directly, view it on GitHub<#39 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AO5RA36SVQWU4276OP5GTI3VACH2FANCNFSM5QYOQOZA>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: ***@***.***>