1) Security by Design is a proactive approach to incorporating security measures into systems from the beginning of development to create robust and resilient systems that can withstand threats. 2) Implementing Security by Design is important because threats are becoming more sophisticated and systems are more complex, so security needs to be integrated into the design process to properly address vulnerabilities. 3) Neglecting security can lead to data breaches, reputational damage, and compliance issues, while Security by Design allows organizations to identify risks early and cost-effectively, gain customer trust, and meet legal requirements.

1. Security by Design – Model for Secure Software Development Life Cycle

2. Introduction
In todays interconnected world, where technology plays a central role in our daily lives, the importance of security cannot be
overstated. With the ever-increasing prevalence of cyber threats and data breaches, organizations and individuals are
recognizing the need for a proactive approach to security. This is where the concept of “Security by Design” comes into play. In
this introduction, we will explore the definition of Security by Design, the reason for its implementation, the challenges and impact
of neglecting security, and the benefits it brings.
1. Definition of Security by Design
Security by Design is a proactive and strategic approach to incorporating security measures into the design and development
of systems, applications, and infrastructure from the very beginning. It involves considering security aspects throughout the entire
lifecycle of a product of system, rather than treating security as an afterthought. By integrating security into the design phase,
Security by Design aims to create robust and resilient systems that can withstand potential threats and protect sensitive data.
2. Reason for Implementing Security by Design
The need for Security by Design arises due to several reasons, Firstly, the threat landscape has become more sophisticated, with
hackers and cybercriminals employing advanced techniques to exploit vulnerabilities. By incorporating security measures from
the outset, organizations can proactively mitigate risks and reduce the likelihood of successful attacks. Secondly, the growing
complexity of modern systems and technologies amplifies the potential attack surface. With interconnected devices, cloud
services. And mobile applications, the attack vectors multiply, making it essential to have security integrated into the design
process. This ensures that potential vulnerabilities are identified and addressed early on, reducing the overall risk exposure.
3. Challenges and Impact of neglecting security
Neglecting security in the design phase can have severe consequences. One of the significant challenges is the potential for data
breaches, which can lead to financial losses, reputational damage, and legal liabilities. Without Security by Design, organizations
are more vulnerable to unauthorized access, data theft, and privacy breaches. Furthermore, the lack of security consideration
can result in system vulnerabilities that may be exploited to disrupt services, compromise integrity, or cause downtime. This can
have a significant impact on business operations, customer trust and brand reputation.

3. Introduction
4. Benefits of Security by Design
Implementing Security by Design brings numerous benefits to organizations. By considering security early in the design process,
potential risks and vulnerabilities can be identified and mitigated before they become significant issues. This proactive approach
reduces the cost and effort required to fix security flaws later in the development cycle.
Additionally, Security by Design instills confidence in customers, partners and stakeholders by demonstrating a commitment to
protecting sensitive information. It enhances trust and can be a competitive advantage in industries where security is a critical
concern.
Moreover, Security by Design enables compliance with regulatory requirements and standards, ensuring that organizations meet
legal obligations and industry best practices.

4. Benefits for an organization:
1. Enhanced Security: By incorporating security measures from the beginning of the development process.
KalesaHealth can build robust and resilient systems, reducing the risk of security breaches, data leaks and
unauthorized access. This protects the integrity and confidentiality of sensitive information, such as employee
data or testing materials.
2. Compliance and Risk Mitigation: Following the ASVS guidelines helps KalesaHealth meet industry best
practices and compliance requirements. By implementing security controls early on, KalesaHealth can
proactively mitigate potential risks, ensuring adherence to data protection regulations, privacy laws and
industry standards
3. Improved Reputation and Trust: Demonstrating a commitment to security by design builds trust among
stakeholders including employees, financial institutions and partners. KalesaHealth can differentiate itself as
an organization that prioritizes the security and privacy of the testing process, leading to an enhanced
reputation and attracting more clients
4. Cost Saving: Integrating security from the outset helps identify vulnerabilities and weaknesses early in the
development cycle. Addressing these issues in the initial stages of development is more cost-effective
compared to retrofitting security measures into a finished product. Moreover, preventing security incident
reduces the potential financial impact of data breaches or system compromises.

5. For each individual team:
QA (Quality Assurance):
• Enhanced Test Coverage: By incorporating security requirements outlined in the ASVS, QA teams can ensure
comprehensive test coverage, including security-focused testing. This help identify vulnerabilities, weaknesses and potential
attack vectors early in the testing process reducing the risk of security incidents.
• Improved Test Efficiency: Integrating security considerations from the start enables QA teams to plan and execute security
tests more effectively. This leads to efficient test cycles, optimized resource allocation, and reduced rework, saving time and
effort in the long run.
Developer:
• Secure Coding Practices: Following the ASVS guidelines helps developers understand and apply secure coding practices,
reducing the likelihood of introducing vulnerabilities into the codebase. By adopting security by design principles, developers
can proactively address security concerns during the development process, leading to more robust and secure applications
• Professional Growth: embracing security by design encourages developers to expand their knowledge and skills in secure
coding practices, threat modelling and secure development methodologies. This investment in professional growth enhances
their expertise and career prospects within the organization
Project Manager:
• Risk Management: Implementing security by design allows project managers to proactively identify and manage security risks
throughout the project lifecycle. By integrating security activities into project planning, risk assessments and mitigation
strategies, project managers can ensure that potential security issues are addressed and managed effectively.
• Successful Project Delivery:: Considering security requirements from the beginning helps project managers deliver projects on
time and within budget. By minimizing security-related delays, rework, and the potential impact of security incidents, project
managers can achieve successful project outcome.

6. For each individual team:
Architects:
• Robust System Design: Security by design principles aid architects in designing systems with a strong focus on security,
reliability and scalability. Adhering to the ASVS guidelines ensures the security controls, such as secure architecture patterns
and access controls, are appropriately integrated into the system design, reducing the risk of vulnerabilities and security
breaches.
• Alignment with Best Practices: Following the ASVS helps architects stay updated with industry best practices and emerging
security trends. By incorporating these practices into the architectural design, architects can contribute to the overall security
posture of KalesaHealth and align with industry standards.
DevOps :
• Automated Security Testing: DevOps teams can leverage security by design principles to automate security testing as part of
the continuous integration and deployment processes. This enables the integration of security tools and testing framework to
identify vulnerabilities early in the development cycle, reducing the time and effort required for manual security assessments.
• Faster Time-to-Market: By addressing security requirements throughout the DevOps pipeline, teams can avoid last-minute
security-related delays and rework. This accelerates the time-to-market for new features and enhancements while maintaining
the integrity and security of the applications.
Technical Support:
• Reduce Incident Response Effort: Integrating security by design principles helps technical support teams mitigate security
incidents proactively. By reducing the occurrence of security-related issues, technical support teams can focus more on
providing timely support and value-added services instead of firefighting security incidents.
• Enhances Customer Satisfaction: By prioritizing security, technical support teams contribute to the overall trust and satisfaction
of customers. A secure testing environment builds confidence among employees and stakeholders, leading to a positive
customer experience and long term loyalty

7. Secure-SDLC Chain Model
The project
manager's roles
and responsibilities
should involve
security in
planning and
organizing the
resources to
successfully
complete projects
CISO aligns
security with
business
objectives and
bottom lines
HR & Admin is a crucial
collaborator in the
planning of incident
response and cyber risk
assessment. The precise
employment data that are
part of people operations
software are a favorite
target for cybercriminals.
For the organization as a
whole to be secure, these
assKalesaHealth must be
protected.
By acquiring all the
qualified services
needed to run and
complete orders for
your clients, third-
party vendors ensure
that business
processes go
successfully.
Planning &
Security
Requirements
Secure Design
& Prototyping
Secure
Development
Security Testing
& Vulnerability
Testing
Secure
Deployment
Maintenance &
Monitoring
Business Leaders Architecture Developers
QA
Devops Tech Support
Sys Admin
Security
HR & Admin
3rd Party Partners
Within an
organization's IT
network, a
security architect
is in charge of
designing,
constructing,
testing, and
implementing
security systems.
It seeks to ensure
the security and
quality of the
software created
for the client
Security testing
ensures that
certain security
standards are
met, and service
needs in QA must
be satisfied.
An addition to DevOps
called DevSecOps
integrates security
management at the
outset and throughout
the development
process. Developers
should think about
security when writing
code, according to
DevSecOps.
Maintaining the
security and
integrity of a
company's
computer systems
and networks
depends on the
security systems
administrator's
job.
Technical support
complies with defined or
authorized organizational
process components, such
as the Primary Incident
Management Plan when
appropriate, to provide
technical support to clients
who require assistance
with client-level hardware
and software.
To secure any
software application
or product,
developers must
have a shared
objective. Each
developer needs to
be interested in the
product's security.

8. Transition from SDLC to Secure SDLC
Traditional
Mindset
Security by design
Mindset
• Testing is only in one stage
and none with the other
stages
Software Development Life Cycle (SDLC) Process
e.g.,
Security
Testing
Planning and
Requirements
Design Development Testing Deployment Maintenance
Secure Software Development Life Cycle (SSDLC) Process
is used to find any
areas where a
business may not be
in compliance with the
Trust Service Criteria
(Security,Availability,P
rocessing
Integrity,Confidentialit
y,Privacy) and then
an action plan is
developed to close
such gaps.
Attack resilience is
increased through the
SDLC's threat modeling.
The ability to proactively
develop countermeasures
to safeguard the security
controls is made possible
by its assistance in
identifying prospective
threats and attack vectors
that can be utilized against
them.
By explicitly designating the
developer as responsible for
code security rather than a
security team, secure
coding illustrates a changing
shift in accountability.
follows best practices for
code security, protects
published code from known
vulnerabilities as well as
those that are unexpected
and unknown.
Planning and
Security Requir
ements
Secure Design
and
Prototyping
Secure
Development
Security
Testing and
Vulnerability
Testing
Secure
Deployment
Maintenance
and Monitoring
A unit test is a
sort of software
test that
concentrates
on a software
product's
constituent
parts.
Automate the
deployment
process at all
stages and add
practical security
validation tests
A vulnerability
rewards program
(VRP), sometimes
known as a bug
bounty program, is a
crowdsourcing
project that pays
people for finding
and reporting
software defects.
e.g., Gap
Analysis
e.g.,
Threat
Modeling
e.g.,
Secure
Coding
e.g.,
Unit Testi
ng
e.g., Build
Routine
Security
Tests
e.g., Bug
Bounty
Program

9. Secure SDLC
phases
Call for Action : Minimum Mandatory Requirements Team Kalesa
Health
PoC
Planning and
Security
Requirements.
1. Define Security Objectives: Clearly establish the security objectives for the project. These objective should align with the organizations security goals
and take into account any specific regulatory requirements or industry best practices that apply. The security objectives will guide the planning and
implementation of security measures throughout the project.
2. Identify Threats and Risks: Collaborate with security stakeholders to identify potential threats and risks associated with the project. Conduct a risk
assessment to evaluate the impact and likelihood of each identified risk. This assessment will help prioritize security efforts and ensure that appropriate
security controls are implemented to mitigate the identified risks.
3. Determine Compliance Requirements: Identify any legal, regulatory, or industry-specific compliance requirements that must be met by the project.
Consider data protection laws, privacy regulations, and security standards that are relevant to the project’s scope. Ensure that the project plan includes
measures to comply with these requirements and that they are properly documented.
4. Involve Security Experts: Engage with security experts, such as information security officers or consultants, to provide guidance and expertise during
the planning phase. Their input can help identify potential security gaps, suggest appropriate security controls, and ensure that security is integrated into
the project plan from the beginning.
5. Establish Security Roles and Responsibilities: Clearly define the roles and responsibilities of project team members regarding security. This includes
assigning individuals who will be responsible for overseeing and managing security-related tasks throughout the project’s lifecycle. Ensure that team
members are aware of their security responsibilities and have the necessary knowledge or training to fulfill them effectively.
6. Include Security Activities in the Project Schedule: Incorporate specific security related activities and milestones into the project schedule. This
includes tasks such as security assessments, vulnerability scanning, security testing, and reviews of security requirements. By explicitly including these
activities and resources are allocated accordingly.
7. Budget for Security: Allocate a portion of the project budget specifically for security-related expenses. This may include investments in security
technologies, security training and awareness programs, third-party security assessments, or hiring external security experts if required. Having a
dedicated budget for security ensures that adequate resources are available to implement necessary security measures.
8. Document Security Requirements: security requirements identified during the planning phase and ensure they are communicated to the development
team. This includes specifying the security controls, mechanisms, and practices that need to be implemented in the project. Clear documentation ensures
that security expectations are understood and followed by all stakeholders involved in the project.
Project
Managers,
Product
Owner,
Heads,
CTO
Secure Design
and Prototyping
1. Secure Design Principles: Ensure that the design of the system incorporates secure design principles. This includes such as the principles of least
privilege, defense-in depth, secure default configurations. And separation of duties. Adopting these principles helps create a robust and secure system
architecture.
2. Threat Modeling: Conduct a comprehensive threat modeling exercise to identify potential threats and vulnerabilities specific to the system being
designed. Collaborate with security experts to analyze the systems architecture, data flow, and potential attack vectors. Use this analysis to determine
appropriate security controls and countermeasures that should be implemented in the design.
3. Authentication and Authorization: Design and implement strong authentication and authorization mechanisms to control access to the system and its
resources. Utilize secure authentication protocols, implement multi-factor authentication where appropriate, and enforce strong password policies.
Implement role-based access controls (RBAC) or attribute-based access controls (ABAC) to ensure appropriate permissions are granted to users.
4. Secure Data Handling and Protection: Design the system with secure data handling practices in mind. Ensure that sensitive data is encrypted both at
rest and in transit. Implement secure data storage mechanisms, such as encrypted databases or secure file systems. Incorporate mechanisms for data
integrity checks and protection against injection attacks, such as SQL injection or cross-site scripting (XSS).
5. Secure Communication: Design the system to use secure communication protocols such as HTTPS, for transmitting sensitive information over networks.
Implement secure socket layers(SSL) or transport layer security (TLS) to ensure data confidentiality and integrity during transmission. Avoid transmitting
sensitive information in clear text or using outdated or vulnerable protocols.
6. Input Validation and Output Encoding: Design the system to perform thorough input validation to prevent common vulnerabilities such as injection attacks
or cross-site scripting. Implement output encoding techniques to protect against HTML injection or other output-based attack. Ensure that all user inputs
are properly validated and sanitized to prevent unauthorized access or code execution.
7. Secure Error Handling: Design the system to handle errors securely, avoiding the exposure of sensitive information. Implement appropriate error handling
mechanisms that provide informative error messages to developers while not divulging sensitive system details to end-users. Avoid displaying stack
traces or debugging information in production environments.
8. Security Documentation: Document the security decisions made during the design phase, including the rationale behind the chosen security controls and
countermeasures. Create detailed design documents that outline the security aspects of the system, including security requirements, threat models, and
secure design considerations. This documentation ensures that the development team and other stakeholders understand the security measures
implemented.
Architecture

10. Specific Actions of Each Team
Secure
SDLC
phases
Call for Action : Minimum Mandatory Requirements Team Kalesa
Health
PoC
Secure
Developme
nt
1. Secure Coding Practices: Adhere to secure coding practices throughout the development process. This includes following coding standards that address
security concerns, such as input validation, output encoding, proper error handling, and secure configuration ,management. Avoid common coding
vulnerabilities, such as SQL injection, cross-site scripting, or buffer overflows.
2. Secure Authentication and Authorization: Implement secure authentication and authorization mechanisms as defined in the design phase. Validate user
inputs to prevent unauthorized access or privilege escalation. Store passwords securely using strong hashing algorithms and ensure the use of secure
session management techniques.
3. Data Protection: Apply appropriate encryption techniques to protect sensitive data at rest and in transit. Use cryptographic libraries or APIs to handle
encryption and decryption securely. Implement mechanisms for secure key management, secure storage of cryptographic materials, and secure handling
of cryptographic operations.
4. Secure APIs and Web Services: Implement secure coding practices when developing APIs and web services. Ensure proper input validation, secure
authentication, and authorization mechanisms and protect against common vulnerabilities like injection attacks, XML external entity (XXE) attacks, or
broken access controls. Validate and sanitize input/output data to prevent data leaks or security breaches
5. Secure Configuration Management: Ensure the default configurations are secure and do not leave unnecessary services or features enabled. Follow the
principles of least privilege when assigning permissions to system components and ensure that access controls are properly implemented and enforces.
Regularly update and patch software components to address security vulnerabilities.
6. Security Testing: Conduct security testing as an integral part of the development process. Perform static code analysis, dynamic application security
testing (DAST), and vulnerability scanning to identify and remediate security vulnerabilities. Test the system’s resilience to common attacks, such as
penetration testing or security-focused quality assurance measures.
7. Error Handling and Logging: Implement proper error handling mechanisms that provide informative error messages to developers while not exposing
sensitive system details to end-users. Ensure that logs capture relevant security-related information to assist in monitoring, incident response, and forensic
analysis. Protect log files from unauthorized access and regularly review logs for any security incidents or anomalies.
8. Secure Third-Party Libraries and Components: Ensure that third-party libraries or components used in the development process are up to date and
free from known security vulnerabilities. Regularly monitor security advisories and apply patches or updates promptly. Verify the security posture of third-
party libraries or components before integrating them into the system.
9. Secure Deployment Practices: Implement secure deployment practices to protect the system during the deployment phase. This includes securely
transferring files, validating integrity during deployment phase. This includes securely transferring files, validating integrity during deployment, and
maintaining secure configurations in production environments. Follow secure DevOps principles, such as infrastructure as (IaC) and continuous
integration/continuous deployment(CI/CD) to ensure security throughout the deployment pipeline.
10. Secure Development Environment: Protect the development environment from security risks by implementing secure coding environments, secure
development tools, and secure version control systems. Restrict access to development environments, secure source code repositories, and use secure
communication channels for code collaboration.
Developers
Secure unit
Testing
1. Security Testing Techniques: Familiarize themselves with various security testing techniques and methodologies. This includes understanding concepts
like penetration testing, vulnerability scanning, security-focused quality assurance, and risk-based testing. Apply these techniques to identify and evaluate
security vulnerabilities in the system.
2. Functional Security Testing: Perform functional security testing to validate that the security controls and mechanisms implemented during the development
phase are functioning as intended. Verify that authentication and authorization mechanisms, input validation, session management, and access controls
are working correctly.
3. Vulnerability Scanning and Assessment: Conduct vulnerability scanning and assessment using specialized security tools. These tools help to identify
common security vulnerabilities, misconfigurations, and potential weaknesses in the system. Regularly scan the system for vulnerabilities and work with
development teams to address any identified issues promptly.
4. Penetration Testing: Conduct penetration testing to simulate real-world attacks and assess the systems resilience to various security threats. Penetration
testing aims to identify vulnerabilities that can be exploited by attackers and provide insights into potential security risks. Collaborate with security experts
to conduct thorough penetration testing and ensure that identified vulnerabilities are properly addressed.
5. Security Test Data: Utilize appropriate test data that reflects realistic security scenarios. This includes using various user roles with different levels of
access privileges, input data that includes potential security attack vectors, and test data that covers edge cases related to security controls. Test the
systems response to different security-related scenarios and ensure it behave securely.
6. Security Test Environments: Maintain separate test environments that closely resemble the production environment to conduct security testing. These
environments should include security configurations, access controls, and secure communication protocols. Avoid using real production data in test
environments to prevent any potential data breaches or exposure.
7. Compliance Testing: Verify that the system meKalesaHealth relevant compliance requirements, such as data protection laws or industry-specific
regulations. Collaborate with compliance teams to ensure that the system adheres to the necessary security controls, privacy requirements, and legal
obligations. Conduct tests to validate compliance and provide necessary documentation for audit purposes.
8. Security Incident Response Testing: Perform testing of the incident response procedures and processes to evaluate the system’s ability to detect, respond
to, and recover from security incidents. This includes conducting drills and simulations to test the effectiveness of the incident response plan,
communication channels, and coordination among stakeholders.
9. Documentation and Reporting: Document all security test activities, including test plans, test cases, test results, and any identified vulnerabilities or
weaknesses. Provide comprehensive reports on the security testing process and communicate the finding to relevant stakeholders. Ensure that all
identified security vulnerabilities are properly tracked and communicated to development teams for remediation.
QA

11. Specific Actions of Each Team
Secure
SDLC
phases
Call for Action : Minimum Mandatory Requirements Team KalesaHea
lth PoC
Secure
Deployme
nt
1. Secure Configuration Management: Ensure that all components of the system, including servers, databases, and network devices are configured securely.
Follow security best practices for hardening configurations, disabling unnecessary services, and applying appropriate access controls. Implement secure
configuration management processes to prevent unauthorized changes or configurations that could introduce security vulnerabilities.
2. Secure Deployment Process: Implement secure deployment practices to protect the integrity and confidentiality of the system during the deployment phase.
Use secure channels for transferring deployment packages and ensure their integrity through checksum verification or digital signatures. Employ secure
deployment tools and techniques, such as code signing and secure update mechanisms, to prevent unauthorized modifications during deployment.
3. Access Controls and Authentication: Implement robust access controls and strong authentication mechanisms for accessing the deployed system. Utilize
multi-factor authentication where appropriate, enforce strong password policies, and ensure the secure storage and transmission of authentication
credentials. Restrict administrative access to authorize personnel only, and regularly review and revoke unnecessary privileges.
4. Secure Network Configuration: Configure the network infrastructure securely to protect the deployed system. Implement firewalls, intrusion
detection/prevention systems, and network segmentation to control traffic and prevent unauthorized access. Encrypt network communications using secure
protocols, such as HTTPS, to protect data in transit. Regularly review and update network configurations to address emerging security threats.
5. Patch and Vulnerability Management: Establish a process for regularly applying security patches and updates to the deployed system. Stay informed about
the latest security vulnerabilities and release patches promptly. Implement vulnerability management practices, such as regular vulnerability scanning and
penetration testing, to identify and address any security weaknesses introduced during the deployment phase.
6. Secure Data Handling: Implement secure data handling practices during the deployment phase. Ensure that sensitive data is appropriately protected at rest
and in transit. Encrypt data where necessary, enforce secure data storage mechanisms, and ensure the secure transmission of data between system
components. Implement data backup and recovery processes to ensure business continuity and data integrity.
7. Secure Logging and Monitoring: Implement robust logging and monitoring mechanisms in the deployed system. Enable logging of security events, system
activities, and user actions to detect and respond to security incidents. Regularly review logs for any suspicious activities or security breaches. Implement
real-time monitoring and alerting mechanisms to proactively identify and respond to security threats.
8. Incident Response Planning: Establish an incident response plan and processes to handle security incidents during the deployment phase. Define roles and
responsibilities, communication channels and incident escalation procedures. Regularly train and update the incident response team, conduct incident
response drills, and ensure that the necessary tools and resources are available to respond effectively to security incidents.
9. Continuous Monitoring and Improvement: Implement continuous monitoring and improvement practices for the deployed system’s security. Regularly
assess and review the security posture of the system, conduct security audits, and perform vulnerability assessments. Stay updated with emerging security
threats and industry best practices to proactively address any security vulnerabilities.
DevOps
Maintenan
ce and
Monitoring
1. Patch and Update Management: Continuously apply security patches, updates and fixes to the system to address any identified vulnerabilities or
weaknesses. Stay informed about the latest security advisories and releases from software vendors and promptly apply patches to mitigate potential
security risks. Implement a patch management process to ensure that updates are deployed in a timely and controlled manner.
2. Vulnerability Management: Conduct regular vulnerability assessments and scans to identify new vulnerabilities or weaknesses that may have emerged since
the system’s deployment. Use automated scanning tools or engage security experts to perform these assessments. Prioritize and remediate identified
vulnerabilities based on their severity and potential impact on the system’s security.
3. Access Control Reviews: Regularly review and update access controls to ensure that only authorized personnel have appropriate access to the system and
its resources. Review user accounts, privileges and permissions to verify that they are aligned with the current needs of the organization. Remove or disable
unnecessary accounts or privileges that are no longer required.
4. Security Incident Monitoring and Response: Implement a robust security incident monitoring and response process to detect and respond to security
incidents promptly. Monitor system logs, security events, and alerts to identify any suspicious activities or potential security breaches. Define incident
response procedures, including escalation paths, communication channels, and incident containment and recovery strategies.
5. Security Awareness and Training: Conduct regular security awareness and training programs for maintenance personnel to keep them informed about
evolving security threats, best practices, and their responsibilities in maintaining a secure system. Raise awareness about social engineering techniques,
phishing attacks, and other common attack vectors to help personnel identify and respond appropriately tp potential threats.
6. Change Management and Configuration Control: Implement a change management process to ensure that any modifications or updates to the system are
carefully assessed. Approved, and tracked. Properly document and review changes to prevent unintended security vulnerabilities. Maintain configuration
baselines and version controls to easily identify and revert any unauthorized or undesired changes.
7. Incident-Post-Mortems and Lesson Learned: Conduct post-incident reviews to analyze and document security incidents that occur during the maintenance
phase. Identify the root causes, lessons learned, and recommendations for improving the system’s security posture. Incorporate these insights into future
maintenance activities to prevent similar incidents from recurring.
8. Regular Security Audits and Assessments: Perform periodic security audits and assessments to evaluate the system’s compliance with security policies,
standards and regulatory requirements. Engage external auditors or security experts, if necessary to provide an unbiased assessment of the system’s
security controls and practices. Address any identified gaps or issues promptly.
9. Documentation and Knowledge Transfer: Ensure that all relevant security-related documentation, including system configurations, security procedures,
incident response plans, and lessons learned, are properly maintained and available for reference. Document any changes made during the maintenance
phase to maintain an updated record of the system’s security configuration
Cyber
Security
team., Tech
Support
Team

12. Glossary
(OWASP) The Open Worldwide Application Security Project -is a group on the internet that creates openly downloadable tools, technologies,
approaches, and papers related to web application security.
Bug Bounty Program - gives rewards to people who find and disclose software bugs; also known as a vulnerability rewards program (VRP).
These crowdsourcing initiatives are frequently employed by businesses as an addition to penetration tests and internal code audits as part of a
vulnerability management plan.