Application free of malicious code
Summary
The application code must be free of malicious code.
Description
There are several ways in which malicious code may be included in an application. It can be imported as part of third party libraries, which may be intentionally malicious or have exploitable vulnerabilities, or it can come as a backdoor left by one of the developers. Therefore, the source code should be audited to guarantee it does not have any backdoors, rootkits, time bombs, logic bombs, etc.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- BSIMM-CR3_4:_3. Automate malicious code detection
- CAPECâ„¢-438. Modification during manufacture
- CWEâ„¢-507. Trojan horse
- CWEâ„¢-510. Trapdoor
- CWEâ„¢-511. Logic/Time bomb
- NERC CIP-007-6_R3_1. Malicious code prevention
- SOC2®-CC6_8. Logical and physical access controls
- Agile Alliance-9. Continuous attention to technical excellence and good design
- NYDFS-500_10. Cybersecurity personnel and intelligence
- MITRE ATT&CK®-M1013. Application developer guidance
- MITRE ATT&CK®-M1016. Vulnerability scanning
- MITRE ATT&CK®-M1044. Restrict library loading
- MITRE ATT&CK®-M1047. Audit
- SANS 25-23. Improper Control of Generation of Code ('Code Injection')
- CMMC-AT_L2-3_2_1. Role-based risk awareness
- CMMC-MA_L2-3_7_4. Media inspection
- CMMC-RA_L2-3_11_2. Vulnerability scan
- CMMC-SI_L1-3_14_2. Malicious code protection
- HITRUST CSF-05_k. Addressing security in third party agreements
- HITRUST CSF-09_e. Service delivery
- HITRUST CSF-09_j. Controls against malicious code
- FedRAMP-CA-2_2. Security assessment - Specialized assessments
- FedRAMP-RA-5. Vulnerability scanning
- FedRAMP-SI-3. Malicious code protection
- ISO/IEC 27002-8_26. Application security requirements
- ISA/IEC 62443-SI-3_2. Malicious code protection
- OSSTMM3-10_9_3. Telecommunications security (configurations verification) - Configuration errors
- OWASP Top 10 Privacy Risks-P1. Web application vulnerabilities
- MVSP-2_5. Application design controls - Security libraries
- OWASP SCP-14. General coding practices
- NIST 800-171-1_7. Prevent non-privileged users from executing privileged functions
- NIST 800-171-1_18. Control connection of mobile devices
- SWIFT CSCF-6_1. Malware protection
- OWASP SAMM-ST. Security Testing
- OWASP ASVS-10_1_1. Code integrity
- C2M2-9_4_d. Implement software security for cybersecurity architecture
- SIG Lite-SL_89. Is there a formal Software Development Life Cycle (SDLC) process?
- SIG Core-I_2_1. Application security
- OWASP ASVS-10_2_1. Malicious code search
- OWASP ASVS-10_2_6. Malicious code search
- CWE TOP 25-94. Improper Control of Generation of Code ('Code Injection')
- ISO/IEC 27001-8_26. Application security requirements
- CASA-10_1_1. Code Integrity
- Resolution SB 2021 2126-Art_15_3_c. Operative Risk Management - Information Technology Factor
- OWASP MASVS-CODE-3. The app only uses software components without known vulnerabilities
Vulnerabilities
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.