Subcontrol 18.7 - Githubissues

adammontville / cis-controls-71-measures

0 stars 0 forks source link

Subcontrol 18.7 #161

Open adammontville opened 5 years ago

adammontville commented 5 years ago

Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to for internally developed software.

Measures

None provided

Metrics

None provided

wmunyan commented 5 years ago

Inputs:

The inventory of internally-developed software (from the organization's software inventory)
The inventory of static analysis tools (from the organization's software inventory)
The inventory of dynamic analysis tools (from the organization's software inventory)

Operations:

Map the inventory of internally-developed software to the applicable static/dynamic analysis tools which are used for verification.

Measures:

M1 = (For each software from Input 1) 1 if the software is verified by static analysis tool(s); 0 otherwise
M2 = (For each software from Input 1) 1 if the software is verified by dynamic analysis tool(s); 0 otherwise
M3 = The number of internally developed software (the count of Input 1)

Metrics:

Static Analysis Tool Coverage = (SUM from 1..M3 (M1)) / M3
Dynamic Analysis Tool Coverage = (SUM from 1..M3 (M2)) / M3