The NCSC’s Technology Assurance activities provide a means to gain confidence in the cyber security of the services and technologies on which the UK relies.
Pages
Page 31 of 35
2. Protect the product from unauthorised access
All assets used to design and build the product should be protected from unauthorised modification.
Management of access to products throughout their lifecycle reduces opportunities for malicious interference.
This means that data, software, systems and component parts should be protected from compromise during all stages of development, build, test, use and maintenance. The integrity of tools used to build a product is as important as the integrity of any data that supports development.
Unauthorised or unexpected changes to a product can be detrimental to the security it offers, and it is much easier to gain confidence in products when they function consistently, conforming to known build specifications that only change when new versions are formally approved for release.
Example defensive measures
Using controlled processes for incorporating changes into both production releases and the tooling used to build a product provides confidence that the product can be built consistently over time. These processes should take into account the relative levels of trust you have in development, build and deployment systems and associated data sources.
Access to data and systems should be effectively controlled, using the principle of least privilege, and access should be removed for those who no longer need it. Different individuals have different levels of influence across a product’s lifecycle. Measures to manage the insider threat should be considered alongside threats from outside the organisation.
Long-term sensitive values held in a product, such as cryptographic secrets, should be protected from exposure to unauthorised parties (see principles 1 and 2 of product design and functionality). Sensitive parameters that are generated through the build process and need to be retained to support ongoing development should also be appropriately protected.
Your processes should minimise opportunities for attackers to gain knowledge of weaknesses in your product. Details of weaknesses revealed during development should be restricted to those who have a need to know. Opportunities to discover additional weaknesses can arise from exposure of detailed technical product information, so you should limit this only to what is strictly necessary during sales and marketing.
