T/CFAS 0003-2019 Abolished Group standards

T/CFAS 0003-2019 Information Security Technology Open Source Code Security Audit Specification

Publish Date: 2019-12-17 Implement Date: 2020-01-01 For services related to genuine standard inquiry, procurement, translation, and other related services in China, please Contact Us

Price: $ 20.00

Out of stock

Basic Information

Standard Code: T/CFAS 0003-2019

Standard Type: Group standards

Standard Status: Abolished

is_force_gb: no

CCS Name: Social public safety

ICS Name: Comprehensive Application of Information Technology

Publish Date: 2019-12-17

Implement Date: 2020-01-01

Scope

Scope: Open-source code security is different from the security monitoring of open-source software usage and open-source environments. Open-source code security audits and vulnerability assessments belong to the application of code-level vulnerability scanning. They mainly conduct a comprehensive security vulnerability scan of the defects existing in open-source code itself and the open-source code packages used and involved by this code, and detect vulnerabilities before the code becomes a software product. This prevents vulnerabilities from emerging before the product is fully developed, reducing the potential security risks after the software is commercialized, and truly achieving prevention before problems occur. This standard mainly specifies various security norms for open-source code security audits and assessments, and further describes and stipulates the security issues and related safety norms that need to be paid attention to at different stages, in order to improve the security of open-source software and its ability to resist attacks. Main technical content: Open-source code security audits can conduct code-level security audits and vulnerability detection from the source of software program development, and effectively classify and manage code vulnerabilities according to their security risk levels. Therefore, code security audits provide an efficient way and method for controlling the security of the code itself. The standards included in open-source code security audits include: a) defining the requirements for open-source code security audits and related industry requirements; b) providing direct support, detailed guidelines, and/or explanations for establishing, implementing, maintaining, and improving the entire process of open-source code security audits; c) proposing open-source code security audit guidelines for specific industries; d) elaborating on the qualification assessment methods for open-source code security audits.