⏱️
Temps de lecture estimé
2 min de lecture
2 min de lecture
Dans le cadre des développements autour d’applications modernes vous avez surement vu passer les références à des normes de sécurité telles que SOC2 (bien que SOC2 ne soit pas une réelle norme de sécurité ) et ISO27000.
Ces normes sont de plus en plus demandées par les clients pour garantir la sécurité des données et des systèmes. A ce titre, il est intéressant de vous proposer un mapping entre le guide OWASP ASVS (Application Security Verification Standard) et les contrôles de sécurité SOC 2 que j’ai pu établir rapidement récemment.
Cela permet de mieux comprendre comment les bonnes pratiques de sécurité d’OWASP peuvent être mises en œuvre pour répondre aux exigences de SOC 2.
🚧 Mapping is currently under construction. Please check back later for updates! 🚧
| Category | SOC 2 Control | Description | OWASP ASVS Requirement | OWASP ressources |
|---|---|---|---|---|
| Security | Logical Access Controls (CC6.1) | Restrict access to systems and data to authorized users. | ASVS-2 Authentication | Authentication Cheat Sheet |
| System Security Settings (CC6.2) | Implement security settings to protect against unauthorized access. | ASVS-14 Security Configuration | ||
| Access Monitoring (CC6.3) | Monitor and log access to detect unauthorized activities. | ASVS-7 Logging and Monitoring | Logging Cheat Sheet | |
| Intrusion Detection (CC6.4) | Detect and respond to intrusions. | ASVS-14 Security Configuration | ||
| Firewall Configuration (CC6.5) | Use firewalls to protect the network perimeter. | ASVS-1.14.1 Network Security | Attack Surface Analysis Cheat Sheet | |
| Vulnerability Management (CC6.6) | Regularly scan for and remediate vulnerabilities. | ASVS-14.1.1 Vulnerability Scanning, ASVS-14.3 Unintended Security Disclosure | Vulnerability Disclosure | |
| Security Incident Response (CC6.7) | Plan and respond to security incidents. | ASVS-14.3 Unintended Security Disclosure | Vulnerability Disclosure | |
| Availability | Business Continuity Plan (CC7.1) | Ensure business continuity during disruptions. | ||
| Disaster Recovery Plan (CC7.2) | Restore services quickly after disruptions. | |||
| Performance Monitoring (CC7.3) | Monitor system performance to ensure availability. | ASVS-7 Logging and Monitoring | Logging Cheat Sheet | |
| Confidentiality | Data Encryption (CC8.1) | Encrypt sensitive data at rest and in transit. | ASVS-9 Communication | Transport Layer Security Cheat Sheet |
| Key Management (CC8.2) | Manage cryptographic keys securely. | ASVS-6.4 Key Management | Key Management Cheat Sheet | |
| Processing Integrity | Input Validation (CC9.1) | Validate inputs to prevent injection attacks and other vulnerabilities. | ASVS-5 Input Validation | Input Validation Cheat Sheet |
| Version Control (CC9.2) | Manage changes to code and configurations. | ASVS-14.1 Build & Deploy | ||
| Privacy | Personal Data Protection (CC10.1) | Protect personal data according to privacy policies. | ||
| Security Awareness Training (CC10.2) | Provide regular security awareness training to employees. | OWASP Top10 | ||
| Data Minimization (CC10.3) | Collect and store only necessary personal data. | |||
| Data Retention and Disposal (CC10.4) | Implement policies for data retention and secure disposal. |