Assess the Security Impact of Acquired Software
Ideally, as technical professionals, you would prefer to trust what software vendors say about their applications. However, as security professionals, you must verify and validate all applications’ capabilities and security. The first step is understanding your business requirements of the application and then making sure it fulfills those requirements in a secure manner.
In this section, you will learn how to assess the security of different types of acquired software such as the following:
- Commercial off-the-shelf (COTS)
- Open source
- Third-party
- Managed services
Let’s first cover secure approaches for COTS software.
COTS
When selecting COTS software, thoroughly evaluate vendor claims to ensure they align with the product’s actual capabilities and your requirements. Conducting a bake-off, in which multiple COTS products that meet your requirements are tested and validated against...
