1

We are looking to provide our Devs and Ops with minimal security baseline requirements - reference materials that they should follow during coding/implementation/etc.

Maybe requirements based on NIST 800-53 - but NIST is too cumbersome - developers would want something that is easier to read and straightforward to the point.

We know there is OWASP Cheat Sheet Series - https://cheatsheetseries.owasp.org

which is the closest we found to somewhat cover some of the security domains.

But is there any other project paid or free that would be useful?

Some of the domains we want to cover:

Application Security
Authentication and Authorization
Certificate Lifecycle Management
CI/CD
Client Applications
Client Security
Encryption
Hardening
Identity and Access Management
Logging, Monitoring and Alerting
Platform Integrity
Platform Resilience
Platform Security
Secrets Management
Third Party Cloud Service Provider
Threat Management
Vulnerability Management
Privacy

The guidance should have gradual breakdowns of the domains - they would have a brief explanations and "Implementation Guidance" describing how it is best to achieve the requirement

1
  • 1
    "How" you achieve what your organisation wants is up to you. That's why standards don't get into the "how". Generally, organisations use established standards, mix them, then add their own requirements. There is no "one way" to accomplish security.
    – schroeder
    Commented Jan 10, 2023 at 0:09

2 Answers 2

1

The canonical security benchmark site is the Center for Internet Security which includes both free and paid options. They've been doing this for over 20 years, and their guides are thorough.

0
0

The NIST Safe Software Development Framework (SSDF) might be what you're looking for. It is based on secure software development practice guidelines from organizations like BSA, OWASP, and SAFECode.

The SSDF defines high-level best practices but does not prescribe practical implementation techniques; its focus is on a secure outcome. It should be used in conjunction with OWASP or CIS controls for additional information on implementing the practices.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .