Secure by Design activities
Guidance for delivery teams and security professionals to help them achieve the Secure by Design principles.
These recommended activities provide good practice guidance that can be tailored to reflect your organisation’s specific structure, processes and resources. They can be applied to both new and active services at different stages of the delivery life cycle.
Examples and tools are provided to help teams implement each activity. The implementation guide includes details of how teams can prepare for transition to Secure by Design within the required timescales.
How senior responsible owners (SROs), service owners and product managers should allocate the appropriate budget, resources and skills to ensure security is embedded within service delivery.
- Considering security within the business case
- Identifying security resources
Includes an example security resources plan - Agreeing roles and responsibilities
Includes the RACI matrix - Tracking Secure by Design progress
Includes the self assessment tracker and an example tracker - Working out the project’s security risk appetite
Includes an example risk appetite statement
How business analysts, product managers and user researchers should involve security and technical architects in considering security in a broader business context.
- Managing third-party product security risks
- Understanding cyber security obligations
Includes the security obligations matrix - Understanding business objectives and user needs
How security professionals and delivery teams can assess threats and reduce cyber security risks by building appropriate security protection in the service.
- Documenting service assets
Includes an example service assets list - Assessing the importance of service assets
Includes an example assets evaluation sheet - Sourcing a threat assessment
Includes an example threat assessment - Performing threat modelling
Includes an example threat model - Performing a security risk assessment
- Agreeing a security controls set for your service
Includes an example controls taxonomy - Responding to and mitigating security risks
- Assessing the effectiveness of security controls
Includes an example security controls implementation tracker
How architects, developers and delivery teams can proactively and reactively manage weaknesses in the service to prevent potential security incidents.
How project managers can work with delivery teams to keep track of how the Secure by Design approach is being followed throughout the life cycle of a service.