English 中文(简体)
软件产品的共同合规标准是什么? [闭门]
原标题:What are the common compliance standards for software products? [closed]
  • 时间:2010-04-27 14:22:38
  •  标签:
  • security
Closed. This question needs to be more focused. It is not currently accepting answers.

这是一个非常笼统的软件产品问题。 我要知道,任何软件产品都适用了哪些合规标准。

I know that question gives away nothing. So, here is an example to what I am referring to. CiSecurity Security Certification/Compliance lists out products ceritified by them to be compliant to the standards published at their website, i.e, cisecurity.org. Compliance could be as simple as answering a questionnaire for your product and approved by a thirdparty like cisecurity or it could apply to your whole organization, for instance, PCI-DSS compliance.

我非常想知道你知道/设计/设计的产品遵守的标准。 给你这个问题背后的背景: 我是数据生成工具的制定者。 该工具在使用过滤器的银行网络应用中帮助掩盖了筛选html的案文。 因此,例如,如果银行申请清单列出用户信息,如果与银行产品相结合,则我的产品就会自动确定单一模式,并掩盖其为预先界定的格式。 因此,我有产品营销小组,希望像遵守规定这样更强烈的措辞能够向更多的银行客户出售。 因此,理解适用于产品的合规情况”是我目前的一个关键研究项目。 我指的是遵守安全。

赞赏你的帮助和建议。

最佳回答

我并不认为有一个专门的理事机构来决定您类型的软件的规格。 个别国家都有自己的隐私法,如果你在美国各州有自己的法律,加利福尼亚是最严厉的法律。

它像你的软件一样,正在分发。 当有人在你的软件中报告脆弱性时(Yes,最终会发生)。 如果一名专业人员提出ug,他们很可能使用Mirte,而Mirte将指CWE号码(BugTraq是一 night夜)。 很少有人认识到,严重存在着数百种不同类型的弱点,并且all<>/strong>软件容易受到影响,即使其技术性。 如果你认为你的软件100%是安全的,那么你就是一只 f子,或者你是一位好销售者ool的。

我认为,CWE-200个家庭对你来说非常重要。 这个家庭最重要的成员是:CWE-213,其中直接提到了你试图派遣的弱点。 rel=“nofollow noreferer”>CWE-549也与你试图防范的情况相似。 重要部分是检查这种妇委会之间的关系,因为有一些相关的弱点适用于你。 例如,CWE-549问题涉及credential management

问题回答

如果我正确理解,你需要找到该软件,将被用于已经具备合规标准的行业。 例如,Vanguard Configuration Manager是一个自动软件扫描仪,能够持续监测IBM系统茨的安全配置环境。 该软件支持执行和利用国家标准和技术研究所(NIST)和国土安全部国家清单方案(NCP)的z/OS和RACF清单。

越来越多的行业和公共企业现在必须遵守这些联邦标准。 如果你想获得银行客户,你就会有一份必须遵守的条例,这些条例必须用你的软件来安装,然后才能浏览。





相关问题
Signed executables under Linux

For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted ...

MALICIOUS_CODE EI_EXPOSE_REP Medium

I run findbugs against all of my code and only tackle the top stuff. I finally got the top stuff resolved and now am looking at the details. I have a simple entity, say a user: public class User ...

XSS on jsbin.com

Anyone know if jsbin.com implements any protection for XSS or other javascript attacks? I see jsbin links used fairly regularly on sites like this one and I can t find any indication from the site ...

Make md5 strong

Im making a website that will intergrate with game that only support md5 hashing metod (atm). Which ofc is not especially safe anymore. But how could i make it stronger? Should I just generate long ...

Why running a service as Local System is bad on windows?

I am trying to find out the difference between difference service account types. I tumbled upon this question. The answer was because it has powerful access to local resources, and Network Service ...

Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...