ISO/IEC 27034 Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Application security

The discipline of building and operating software so that the application and its data remain confidential, integrity-protected and available under both normal and adversarial conditions across the whole lifecycle.

ISO/IEC 27034 purpose

A multi-part standard providing a framework and processes for specifying, implementing, verifying and maintaining application security controls, supporting rather than replacing an organization's ISMS.

Application Security Control

A documented control applied to an application to meet a security objective, carrying an identifier, objective, implementation guidance, verification method and expected evidence, and reusable across applications.

Organization Normative Framework

The organization-wide reference framework containing application security policy, roles, processes and the Application Security Control Library, from which application-specific frameworks are derived.

Application Normative Framework

The application-specific framework derived from the ONF, recording the selected and tailored controls, the target security level and the evidence produced for that one application.

Risk-based control selection

The rule that controls are chosen according to the assessed security requirements and risk of each application, so higher-risk applications receive stronger controls and deeper verification.

Technology-agnostic framework

A property of ISO/IEC 27034 meaning it defines processes and control structures independent of programming language, platform or vendor, so it can be applied to any application type.

Lifecycle coverage

The framework's allocation of security activities to requirements, design, development, verification, deployment, operation, maintenance and decommissioning, rather than to a single phase.

ISO/IEC 27034 Part 1

The part covering overview, concepts and the general framework model, including definitions of the ONF, ASCL and ANF and their relationships.

ISO/IEC 27034 Part 2

The part addressing the organization normative framework and the processes for establishing, operating and maintaining it, including defining and validating application security controls.

Application Security Control Library

A structured repository within the ONF holding application security controls in a consistent form so they can be selected, compared, reused and maintained over time.

Framework hierarchy

The three-level structure of organizational framework, then application framework, then individual controls, with traceability maintained from requirements and risks down to controls and evidence.

ONF contents

Organizational application security policy, roles and responsibilities, processes, the control library, and the rules for evidence and verification that applications must follow.

ANF contents

For one application: selected controls with justification, any tailoring and its rationale, the target security level, verification results and recorded residual risk acceptance.

Framework elements

The recurring components of the framework: roles, security level target, risk assessment results, selected controls, verification evidence and records demonstrating implementation.

EDITION CAVEAT

Part numbers, titles and publication dates of ISO/IEC 27034 change across editions, so specific part-level claims should be verified against the currently published standard.

ASC attributes

The structured fields describing a control: unique identifier, objective, description, source reference, implementation guidance, verification method, expected evidence and applicable lifecycle phase.

ASC categorization

Grouping controls by lifecycle phase, such as requirements, design, coding, testing, deployment and operation, or by security objective such as authentication, input validation, logging and cryptography.

ASC selection rule

A control is selected when it addresses an identified security requirement or risk for the application, and the selection with its justification is recorded in the application framework.

ASC tailoring rule

A control may be adapted to the application's technology and context only if the adaptation and its rationale are documented and the control's security objective is still achieved.

Evidence-based verification

Confirming a control through its defined method, such as review, test, scan or inspection, and retaining objective evidence that it is implemented and effective.

ASC reuse

Applying an existing control from the library to a new application, which reduces effort and increases consistency but requires re-confirming that the control is applicable to the new context.

ASC vs 27002 control

ISO/IEC 27002 controls are generic information security controls, whereas application security controls are application-specific and carry implementation guidance, verification method and evidence requirements.

Control objective preservation

The principle that tailoring or adapting a control must not weaken the security objective it was selected to achieve; otherwise a different or additional control is required.

Assessment sequence

Derive requirements from business, legal and risk inputs, assess risk, set the target security level, select controls, implement, verify and record evidence in the application framework.

Target security level

The assurance level set for an application based on its risk, determining how strong the selected controls must be and how rigorous and independent the verification must be.

Assurance vs assertion

Assurance rests on recorded, verifiable evidence traceable to requirements and risks; an unsupported statement that controls exist is an assertion and does not constitute assurance under the framework.

Residual risk acceptance

Formal acceptance by an accountable role of the risk remaining after controls are applied, recorded as part of the application's evidence set.

Verification methods

Techniques used to confirm controls, including document and design review, code review, static and dynamic testing, penetration testing, configuration inspection and operational monitoring.

Assurance re-trigger

Reassessment of controls and evidence when the application, its environment, its data sensitivity or the threat landscape changes materially.

ONF adoption path

Establish the organizational framework and control library, pilot on selected applications to build application frameworks, integrate into the lifecycle, then scale and maintain.

Lifecycle gate integration

Embedding application security activities into existing gates such as requirements baseline, design review, code review and release approval instead of running a parallel security process.