Comments (6)
My $0.02. Yes, it's in ISO 27002. Application resiliency and rapid recovery is the current trend in application security, so I believe it should be included.
from devguide.
CIA are the atomic principles of security; meaning they cannot be decomposed and still be a security principle. Availability is the generalization of resilience.
from devguide.
I don't see why a chapter about backups and restoration cannot exist in its own right-- it is a rather important topic that people may want an overview on. Additionally, what good is keeping the live data safe if a malicious entity can try capturing a backup, necessitating a cursory effort at keeping that collection of the everything safe.
In general and at the very least, I try to mention the base of complex ideas that the reader can deep dive on if desired. I am treating the dev guide as a source for exposure to ideas that they may not see without a guiding hand, which in turn will allow them to fill in the higher level exact details of their own knowledge if they are so inclined.
from devguide.
In information security, the aim is Business Recovery rather than something as specific as Backups so we would need to keep the line clear between whether we are covering the general or the specific. Business Recovery includes processes, personnel, alternate sites etc. whereas from a development perspective, we would only be able to touch a small part of that.
from devguide.
Indeed, it is a very common and dangerous mistake to assume that Business (Disaster) Recovery, and Business Resilience, and Backups and restores are the same (or can be serviced by the same criteria). but practise in a development environment is a step towards a good production environment. I experienced at a Large telco (that ajv will know well) a situation where a large SW Company had been doing application development on a multimillion dollar development platform, that even had a Storagetek tape robot attached, and hadn't had a backup done in two years. Development is still a production process in the voyage towards actual production.
from devguide.
Agreed that business continuity is certainly one of the central domains of security, but closing this issue because it will not be included in the Developer Guide itself
from devguide.
Related Issues (20)
- Complete Cryptography chapter HOT 1
- GitHub does not have an official image/file upload interface - workaround inside HOT 12
- Refactor: Accountability HOT 2
- RBAC.jpg
- Refactor: Session Management chapter HOT 2
- ABAC.png
- access_control_models.png HOT 3
- AuthCode.png
- ImplicitGrant.png
- ResourceOwnerPassword.png
- ClientGrant.png
- ABAC_Architecture.png
- The introduction.md stops midsentence! HOT 3
- No mechanism to assist with translations HOT 2
- Concatenate Markdown Documents and Convert to PDF Document HOT 4
- 'Guild' should say 'Guide' in book summary HOT 1
- Publish on https://www.gitbook.com/@owasp HOT 12
- Nothing related with the repo! PLEASE READ HOT 1
- is there any recent version of this guide? this one seems to be bit old. HOT 9
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from devguide.