54 docs tagged with "validação"

This document has been integrated into the Base Requirements Catalogue. See lista-requisitos-base.

Reinforced recommendations for environments with greater regulatory demands or maturity

Advanced practices to reinforce the security, traceability and auditability of critical deployments.

Reinforced practices and optional recommendations for organisations with greater maturity in secure development

Strategies for annotating security validation decisions and evidence in the code itself or in the development cycle

Validation criteria per requirement (ARC-001 to ARC-013), with methods, moments and owners, organised by risk level

Prescriptive validation, evidence and control strategies to ensure a secure, auditable and verifiable adoption of Infrastructure as Code.

Binary control checklist of the adoption of monitoring, alerting, incident response and continuous operational health signal practices.

Objective and binary verification of the application of secure deployment practices in a specific project.

Binary, auditable checklist to assess the practical adoption of the practices prescribed in Chapter 06 - Secure Development

Binary, traceable verification checklist of the adoption of the practices of Chapter 13.

Validations of the pipeline's own code (YAML, scripts, linters), including control of logic, permissions and the use of external components.

Strategies and cycles for keeping validations, KPIs and exceptions auditable

Checklist and structured validation model for the screening, approval and onboarding of contractors

Practices for managing and validating external dependencies to ensure integrity, currency and security in the code

Testing with unexpected or malformed data to discover flaws in parsers, APIs and internal logic.

Prescriptive rules to ensure that security test results are verifiable, reproducible and auditable, with protection of critical assets and separation between automated signal and human decision.

Specifics of exception management in the context of secure development - SAST, linters and code review

Specifics of exception management in the context of the application requirements of Ch. 02

Ways of validating, reinforcing and governing the application of the controls defined in other chapters of SbD-ToE

Definition of formal roles, responsibilities and the application security decision flow

Prescription for the controlled use of automated generation tools (including AI) in development, without changing the application requirements

How to apply secure development practices in each phase of the SDLC, with reusable user stories, auditable artefacts and an L1–L3 proportionality matrix

Integration of requirements practices throughout the phases of the development lifecycle

Practical integration of continuous validation practices across the different phases of the application lifecycle

How to integrate threat modelling practices into technical architecture artefacts and approval processes

Rules and tools for security validation directly in the development environment (pre-commit, IDE, CLI)

Formal policies required to ensure the security, reversibility and traceability of deployments in production.

Policies needed to frame and reinforce the secure development practices defined in this chapter

Formal policies required to legitimise and operationalise the continuous validation of application security.

Case study illustrating the application of requirements throughout the lifecycle

Identification and treatment of the risks inherent to the Threat Modelling process, regardless of the method used

Example of a technical quiz used for knowledge validation in the onboarding process.

Policies that underpin the definition, exception and validation of requirements

Binary and auditable checklist to verify the practical application of the security prescriptions for IaC.

Binary, auditable checklist for controlling the application of the secure architecture requirements

Mandatory per-project verifications to guarantee the application of the defined requirements

Binary, auditable checklist of the adoption of the threat modelling practices of Chapter 03

Security contractual clauses in contracts with suppliers, contractors and technical third parties

Visual diagrams of the governance, exception and formal validation flows

Definition, application, validation and traceability of application security requirements by risk level

Organisational policy that defines how security requirements must be selected, documented, traced, validated and maintained throughout the lifecycle of each application, proportionally to its classified risk level.

Complete model for validating the requirements of the SbD-ToE catalogue - principles, methods by requirement type, lifecycle moments and a detailed plan by domain with operational tag, recommended method and expected evidence.

Techniques and tools to ensure the presence of security controls directly in source code

Application of static testing to source code for early detection of vulnerabilities and security flaws.

Process for security validation of suppliers, contractors and technical third parties

Mapping known threats is an essential mechanism for validating the risk analysis, ensuring that the identified risks reflect real, plausible and documented attack vectors.

Requirements and practical validations to ensure the existence, integrity and impact of threat modelling in the CI/CD lifecycle

🎯 Objective

Practical upskilling for technical teams that develop, review or operate IaC projects securely

Prescriptive rules for the secure use of automation/assistance in writing and changing IaC, with validations and evidence by risk level

Good practices and controls for the secure use of generative AI tools in code writing and automated review

Acceptance criteria, human validation and minimum evidence for threat models

Minimum questionnaire to validate the knowledge of external staff with technical permissions