Version | 1.0 |
Owner | Head of Engineering |
Last Updated On |
|
Last Updated by | |
Approved by |
...
Significant code changes must be reviewed and approved by Tech Lead before being merged into any production branch in accordance with the Check-In Process found here: <link to process outline in company wiki>.
Change control procedures shall ensure that the development, testing, and deployment of changes shall not be performed by a single individual without approval and oversight.
...
At a minimum, the following secure-by-design and privacy-by-design principles shall be applied:
Secure-by-design principles:
Minimize attack surface area
Establish secure defaults
The principle of Least privilege
The principle of defense in depth
Fail securely
Don’t trust services
Separation of duties
Avoid security by obscurity
Keep security simple
Fix security issues correctly Privacy-by-design principles:
Proactive, not Reactive; Preventative not Remedial
Privacy as the Default Setting
Privacy Embedded into Design
Full Functionality – Positive-Sum, not Zero-Sum
End-to-End Security – Full Lifecycle Protection
Visibility and Transparency – Keep it Open
Respect for User Privacy – Keep it User-Centric
Engineering documentation and technical references can be found in the Trello Board for Developer Onboarding.
...
The acquisition of third-party systems and software shall be done in accordance with the requirements of the ecoPortal
Developer Training
Software developers shall be provided with secure development training appropriate to their role at least annually. Training content shall be determined by management but shall address the prevention of common web application attacks and vulnerabilities. The following threats and vulnerabilities should be addressed as appropriate:
...