2cac8686_plication_Security_and_Privacy__Derived_Security_Controls
Lack of protection from SQL injection [Derived Security Controls] 
Create and maintain a process for other people and organisations to report security issues about your applications Create and maintain a procedure for assessing and fixing security flaws in custom application code, and include these issues in the software patching documentation (see above), and if SQL injection is found in one place, examine similar code elsewhere Identify who is responsible for preventing SQL injection in each custom coded application (e.g. software such as websites developed by/for the organisation) Require the default to be to use the safest server-side method for database queries supported by the API or framework Ensure the prevention, detection and remediation of SQL injection vulnerabilities are included at multiple stages of the software development lifecycle (e.g. coding standards, peer/independent code review with audit trail, automated code review, automated vulnerability assessment, penetration testing before going live) Use the software patching policy and processes (see above) for software components used by the custom applications Include a requirement in contracts with third party development to build security into their development practices and inform you when they become aware critical vulnerabilities like SQL injection, and then provide patches Use automated application vulnerability assessments (scanning) to help identify SQL injection, but ensure these cover all the application (e.g. for authenticated customers and administrators too) Undertaking penetration testing in the production/live environment of custom-built applications (external and internal-facing) that interact with databases and other data stores, and repeat periodically
Privacy : Application Security and Privacy
Derived Security Controls