The NCSC’s Technology Assurance activities provide a means to gain confidence in the cyber security of the services and technologies on which the UK relies.
Pages
Page 33 of 35
4. Review and improve the security offered by a product
Put mechanisms in place to ensure product security keeps pace with external developments.
Activities conducted during development can give users and developers confidence in the security of a product when it is launched. However, the nature of threats, and of the state-of-the-art available to attackers looking to exploit a product will evolve through its lifetime. So, security measures should be continuously reassessed over time against the prevailing threat environment, and developers will need mechanisms in place that enable them to update and upgrade their products.
Ideally, you will be able to identify and mitigate security vulnerabilities before an attacker can exploit them. Product developers can gain information on vulnerabilities from a range of sources:
their own analysis of known defects
reports from users
work by security researchers
ongoing testing
Importantly, mitigations do not have to be reactive. You may have advance notice that a particular technology which you depend on is coming out of support. You can use this time to develop alternatives.
Example defensive measures
Performing security-focussed testing and verification regularly, informed by the threats you expect your product to be exposed to, can help ensure that security issues do not recur once they have been encountered for a first time. You should also provide mechanisms for easy disclosure of vulnerabilities, from users and security researchers, so that mitigations can be developed before flaws can be exploited.
Studying user interactions with a product can help you learn where it is not being used as expected, to the detriment of security, and will enable you to implement changes that lead to better security outcomes. Good usage monitoring (see product design principles) can help you actively identify attempts to bypass or subvert security measures.
Maintaining and regularly reviewing a log of all defects in a product will enable developers to identify security implications and prioritise remediation. Following a clear roadmap for security improvements will help ensure the product continues to offer the best possible protection as it is developed over time.
Product updates that address security issues should be made available promptly, to minimise the window of opportunity for an attacker. Investing in additional capacity at design time means that improvements can be implemented without being constrained by performance or storage limits.
