The NCSC’s Technology Assurance activities provide a means to gain confidence in the cyber security of the services and technologies on which the UK relies.
Pages
Page 32 of 35
3. Monitor services used by a product
Maintain awareness of the security status of all services used by the product.
A product may be dependent on other services to operate, with some being critical to maintaining security. For some services, availability will be paramount. In other cases, services may increase the attack surface of the product, especially as more becomes known about the service and its connection to a product.
Some services – for example, web hosting and cloud storage - may be offered by established global service providers, while others might be provided by the same organisation that develops the product. Outsourcing service provision can offer many advantages but it is important to ensure that outsourced services respect the security needs and expectations of users throughout the lifetime of a product.
Example defensive measures
Continuous monitoring of the security status of all services on which a product depends means you can respond promptly if new risks are identified. “Right of audit” clauses in contracts, exercised periodically, can help you maintain confidence in a service providers’ security posture.
You should have processes to help you maintain awareness of planned or actual changes to services or service providers. These could include internal changes in their technology or the details of their service provision, but also external factors such as the geographical location of their operations, or use of new subcontractors.
Accreditations or certifications from relevant bodies, maintained throughout the lifetime of your product, can help you gain confidence in the security of services your product depends on. If necessary, you can supplement this by commissioning your own security assessments.
You should require service providers to give immediate notification in the event that the security of their service is compromised. This will enable you to assess the impact for your product, and implement mitigations to protect users promptly.
