Application Implementation Policy

Version: 1.00Issue Date: 2/4/2015

This Application Implementation Policy specifies how application programs and new projects shall be implemented.

1.0 Overview

This Application Implementation Policy will help ensure that new projects and applications are developed in a planned way so they are both secure and provide the desired functionality to the customer.

2.0 Purpose

This Application Implementation Policy is intended to ensure that all new projects are developed efficiently while providing desired functionality, security, and quality.

3.0 Scope

This Application Implementation Policy applies to all new projects involving software development whether they are done internally or externally. It covers projects contracted to external entities outside the organization that are contracted by the organization. This policy is effective as of the issue date and does not expire unless superceded by another policy.

5.0 Requirements

  • The Development Life Cycle Policy must be followed.
  • The Change Management Policy must be followed.
  • Development of all software must meet minimum software Standards.

6.0 Development Standards

  • All user input must be verified to prevent attacks such as SQL or email injection.
  • Sensitive information may not be stored in cookies.
  • User passwords may not be stored in clear text on the client computer.
  • User passwords should not be transmitted over unsecure media in the clear.
  • Access to sensitive data should not be allowed without authentication and authorization.
  • Calls to databases must be through stored functions which are typically stored on one file seperate from the main part of the software. Database calls should not be direct to the database. Storing the database calling functions in their own file will allow easy modification of the project should database requirements change.
  • Separation of presentation from code.
  • Checking of length of all input whether user input, network input, input from files or any source to be sure the input size is not greater than the buffer size.
  • Required error condition checking when:
    1. File access fails.
    2. Registry access fails.
    3. One or more configuration files are not available.
    4. A library file is unavailable.
    5. Provision to be sure library files or configuration files are not tampered with and the files are valid when used by the program.
    6. Modification of system environment variables cannot compromise the security of the program or cause a different library or configuration file to be substituted.
  • Some minimum amount of comments per line, at the start of the program, and at the start of procedures or functions must be required.

7.0 Testing Standards

The application must have unit testing, system testing, and user acceptance testing performed as a minimum. The user must formally sign off indicating satisfactory user testing before the deliverable is accepted.

  • A written test plan must be created and given to the project manager.
  • The application must be tested for buffer overflow where user input is allowed.
  • The application must be tested against email injection and SQL injection attacks.
  • The application must be tested against possible error conditions that could jeopardize security, reliabilty, or critical business functionality.
  • The application must be tested to be sure it meets all required business functionality
  • A written report documenting test results must be created and provided to the business owner and the project manager.

8.0 Software Functionality

When designing software considerations must be given to the functionality that is being provided to the user and ways that unscrupulous individuals may attempt to pervert that functionality. Examples are:

  • Creating accounts - Creating extra accounts or fradulent accounts by one person.
  • Performing password resets - Using the ability to reset a password to gain unauthorized access to someone else's account.
  • Contacting the webmaster - Using the contact page to send spam email.
  • Submitting sites - Submitting spam sites and using robots to submit mass quantities of sites and overloading the database or site receiving submissions.
  • Adding content to web sites - Finding a security flaw which allows untrusted sources to add spam content.
  • Allowing users to rate items - Fraudulent ratings of items to make an item look better than it is or make the competition look worse.

9.0 Other Policies

  • Change Management Policy
  • Third Party IT Service Policy
  • Software Standards
  • Development Life Cycle Policy

10.0 Enforcement

Since proper application implementation is important for protecting internal systems and information stored by the organization, employees that purposely violate this policy may be subject to disciplinary action up to and including denial of access, legal penalties, and/or dismissal. Any employee aware of any violation of this policy is required to report it to their supervisor or other authorized representative.

Approval

Approved by:__________________________ Signature:_____________________ Date:_______________