Maintain a Vulnerability Management Programme
6
Develop and Maintain Secure Systems and Software
All system components and software must be protected from known vulnerabilities through timely patching and secure development practices. Custom and bespoke software must be developed securely, with code reviews or application security testing. Public-facing web applications require additional protections.
Control Intent
Prevent exploitation of known and unknown vulnerabilities in system components and custom software through timely patch management, secure software development lifecycle practices, and application-level protections.
Common Failures
- Critical security patches not applied within the one-month timeframe, leaving known vulnerabilities exploitable
- Custom application code deployed to production without security code review or testing
- Public-facing web applications lacking a WAF, exposing them to injection and cross-site scripting attacks
- Payment page scripts not inventoried or monitored, enabling Magecart-style skimming attacks
- Developers not trained in secure coding practices, introducing common vulnerabilities into custom software