What is the minimal security standard needed for this type of software product

Question

Actions described in security standards (like ISO 27002, PCI-DSS, HIPAA, Common Criteria) greatly vary according to the domain data that they store, process, transmit and report.

We have a product which collects metrics from a network/wifi enabled luminaries (lighting device) and make analytics data for trend analysis or energy efficiency calculations. What is the minimal security standard that the product needs to meet? It has a device discovery module, data aggregation and a reporting web-app hosted in the cloud and the data moves from enterprise to cloud platform.

I am thinking of at least OWASP 10 but then its not standard rather guidelines of security controls for web-application.

Answer 1

What is the minimal security standard that the product needs to meet?

This largely depends on procurement requirements you are trying to meet. For US federal government the bare minimum to get on the list is FIPS 140-2 certification of your cryptographic module. For DoD there is JITC certification. For NSA and such you have NIAP and Common Criteria. However, I don't think you are trying to do any of this.

Instead, I think you are trying to establish a benchmark for a bare minimum effort to secure your product. To do this, I suggest you should regularly patch every third-party library you use (e.g. OpenSSL), then run a vulnerability scanner, like Nessus, and follow up with a static code analysis tool, like Coverity, applicable to your language. This approach will get you to 'minimal security' if you integrate it into your QA process.