{"id":23824,"date":"2020-08-27T17:07:04","date_gmt":"2020-08-27T20:07:04","guid":{"rendered":"https:\/\/www.epimedsolutions.com\/politica-de-desenvolvimento-seguro-de-software\/"},"modified":"2021-11-11T08:50:53","modified_gmt":"2021-11-11T10:50:53","slug":"secure-software-development-policy","status":"publish","type":"page","link":"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/","title":{"rendered":"Secure Software Development Policy"},"content":{"rendered":"

[vc_row el_id=”policy-section-summary”][vc_column width=”3\/12″][vc_raw_html]JTVCY2Etc2lkZWJhciUyMGlkJTNEJTIyMTg1ODYlMjIlNUQ=[\/vc_raw_html][\/vc_column][vc_column width=”7\/12″]

\n\t
\n\t\t
\n\t\t\t
\n\t
\n\t\t\t\t\t

\n\t\t\t\tSecure Software Development Policy\t\t\t<\/h3>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]<\/p>\n
    \n
  1. 1. <\/a>PRESENTATION AND OBJECTIVES<\/span><\/a><\/li>\n
  2. 2. <\/span><\/a>DATA STORAGE<\/a>\n
      \n
    1. 2.1 Procedures and Media for Data Storage<\/li>\n
    2. 2.2 Permissions for Accessing Information in Databases<\/li>\n
    3. 2.3 Password Management and Distribution for Data Access<\/li>\n<\/ol>\n<\/li>\n
    4. 3. PASSWORD MANAGEMENT AND DISTRIBUTION FOR DATA ACCESS<\/span><\/a>\n
        \n
      1. 3.1 Authorization and Authentication of Users<\/li>\n
      2. 3.2 Authentication on Web Systems<\/li>\n<\/ol>\n<\/li>\n
      3. 4. SECURE COMMUNICATION<\/span><\/a><\/li>\n
      4. 5. <\/span><\/a>ATTACKS ON SYSTEMS AND THEIR DEFENSES<\/a><\/li>\n
      5. 6. <\/span><\/a>AUDITING, TRACKING AND LOGS<\/a>\n
          \n
        1. 6.1 Examples of events that can be logged:<\/li>\n
        2. 6.2 Examples of information that can be stored, related to each event:<\/li>\n<\/ol>\n<\/li>\n
        3. 7. PREVENTION, REACTION AND MITIGATION OF SECURITY BREACHES<\/span><\/a>\n
            \n
          1. 7.1 Backups<\/li>\n
          2. 7.2 Tests<\/li>\n
          3. 7.3 Incidents<\/li>\n<\/ol>\n<\/li>\n
          4. 8. DEVELOPMENT ENVIRONMENT<\/span><\/a>\n
              \n
            1. 8.1 Source Code Access<\/li>\n
            2. 8.2 Separation of Environments<\/li>\n<\/ol>\n<\/li>\n
            3. 9. DATA PROTECTION<\/span><\/a>\n
                \n
              1. 9.1 Cryptography and Hashing<\/li>\n
              2. 9.2 Passwords<\/li>\n<\/ol>\n<\/li>\n
              3. 10. SOFTWARE LIFE CYCLE<\/span><\/a>\n
                  \n
                1. 10.1 Design<\/li>\n
                2. 10.2 Coding<\/li>\n
                3. 10.3 Maintenance<\/li>\n
                4. 10.4 Personnel<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                  [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-1″ css=”.vc_custom_1598555296159{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″]

                  \n\t
                  \n\t\t
                  \n\t\t\t
                  \n\t
                  \n\t\t\t\t\t

                  \n\t\t\t\t1 - PRESENTATION AND OBJECTIVES\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This document is a guide to secure software development within <\/span>Epimed Solutions.<\/b> Its objective is to serve as a guide of good practices to be adopted by analysts and software developers, making the process of designing systems more reliable, auditable, stable and protected against threats. The guidelines contained herein are aimed at everyone involved in the software development process within the scope of <\/span>Epimed Solutions.<\/b><\/p>\n

                  Epimed Solutions is concerned with protecting the confidentiality of Personal Data and\/or Sensitive Personal Data from Patients or customers that are obtained in any way through its software, in accordance with General Data Protection Regulation (EU) 2016\/679 (\u201cGDPR\u201d). For this reason, <\/span>Epimed Solutions<\/b> has established the Personal Data Protection and Privacy Policy. All guidelines contained in this document must be interpreted in accordance with the guidelines of the Personal Data Protection and Privacy Policy, which will always prevail in any eventual conflict with the guidelines of this document.<\/span>[\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-2″ css=”.vc_custom_1598555405295{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″]

                  \n\t
                  \n\t\t
                  \n\t\t\t
                  \n\t
                  \n\t\t\t\t\t

                  \n\t\t\t\t2 - DATA STORAGE\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section presents definitions and guidelines that deal with the storage of confidential or non-Sensitive Personal Data information and its availability. It describes procedures for the secure storage of information in databases. It details the management of access permissions and distribution of passwords to be adopted for the operationalization of these structures.<\/span><\/p>\n

                   <\/p>\n

                  2.1 Procedures and Media for Data Storage<\/b><\/p>\n

                    \n
                  • You should not use a storage medium that does not have access for reading and writing restricted by password.<\/span><\/li>\n
                  • Y<\/span>ou should preferably store encrypted data.<\/span><\/li>\n<\/ul>\n

                    2.2 \u00a0Permissions for Accessing Information in Databases<\/b><\/p>\n

                      \n
                    • Applications should not have access to any database utilizing a user login with root permissions.<\/span><\/li>\n
                    • Applications should not have access to any database utilizing a user login with permissions to execute commands in Data Definition Language (DDL).<\/span><\/li>\n
                    • Applications should not have access to any database utilizing a user login with permissions beyond those strictly necessary for its operation.<\/span><\/li>\n<\/ul>\n

                      2.3 Password Management and Distribution for Data Access<\/b><\/p>\n

                        \n
                      • The creation of passwords that do not follow the standards established by <\/span>Epimed Solutions<\/b> should not be allowed.<\/span> Passwords must have at least 6 (six) alphanumeric characters, using special characters (@ # $%).<\/span><\/li>\n
                      • Password storage in source code should not be used.<\/span><\/li>\n
                      • User data and systems using each password provided must be securely stored.<\/span><\/li>\n
                      • The same passwords should not be used for development, testing, homologation and production environments.<\/span><\/li>\n<\/ul>\n

                        [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-3″ css=”.vc_custom_1598555420662{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″]

                        \n\t
                        \n\t\t
                        \n\t\t\t
                        \n\t
                        \n\t\t\t\t\t

                        \n\t\t\t\t3 - PASSWORD MANAGEMENT AND DISTRIBUTION FOR DATA ACCESS\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section presents definitions and guidelines that deal with controlling access to data and assigning the necessary permissions.<\/span><\/p>\n

                         <\/p>\n

                        3.1 \u00a0Authorization and Authentication of Users<\/b><\/p>\n

                          \n
                        • Passwords should not be stored in plain text without using a salted secure hash algorithm.<\/span><\/li>\n
                        • Nominal user and password control must be used to determine the user’s identity.<\/span><\/li>\n
                        • Authentication via AD should be used whenever possible to authenticate internal users.<\/span><\/li>\n
                        • Users must be made aware of the permissions and levels of access they have.<\/span><\/li>\n
                        • Active Directory (AD) groups should be used to determine access policies and user roles. <\/span><\/li>\n<\/ul>\n

                           <\/p>\n

                          3.2 Authentication on Web Systems<\/b><\/p>\n

                            \n
                          • Since HTTP is a stateless protocol, which uses cookies to maintain user sessions, it is necessary to guarantee both the security of the exchange of credentials and also that of other pages accessed by users of web systems. The HTTPS protocol aims to contribute to ensuring that security is guaranteed.\u00a0<\/span>
                            \n<\/span><\/li>\n
                          • Thus, HTTPS must be used in all system screens<\/span><\/li>\n<\/ul>\n

                            [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-4″ css=”.vc_custom_1598555756427{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″]

                            \n\t
                            \n\t\t
                            \n\t\t\t
                            \n\t
                            \n\t\t\t\t\t

                            \n\t\t\t\t4 - SECURE COMMUNICATION\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section presents definitions and guidelines that deal with the secure transmission of Sensitive Personal Data between systems, in order to safeguard the integrity, authenticity and other attributes pertinent to the use of communicated data. <\/span><\/p>\n
                              \n
                            • A communication channel with control of duplication and loss of information\/messages must be used. Thus, HTTPS must be used in all system screens.<\/span><\/li>\n
                            • A communication channel that provides integrity control of transmitted data (HTTPS) must be used.<\/span><\/li>\n
                            • A communication channel with authentication control (HTTPS, digital certificates generated by trusted authorities, VPNs) must be used.<\/span><\/li>\n
                            • The data to be transmitted at both ends of the communication must be securely stored.<\/span><\/li>\n
                            • A communication channel that provides confidentiality of the transmitted data (HTTPS and VPNs) must be used.<\/span><\/li>\n<\/ul>\n

                              [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-5″ css=”.vc_custom_1598556699767{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″]

                              \n\t
                              \n\t\t
                              \n\t\t\t
                              \n\t
                              \n\t\t\t\t\t

                              \n\t\t\t\t5 - ATTACKS ON SYSTEMS AND THEIR DEFENSES\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section provides guidelines for enhancing system resilience to attacks against systems and applications. It is recommended that the main known attacks be prevented, in order to prevent malicious attacks from compromising the security of the system, exposing Sensitive Personal Data and performing unauthorized operations, among other possible vulnerabilities. <\/span><\/p>\n
                                \n
                              • SQL injection attacks (SQL Injection) must be prevented.<\/span><\/li>\n
                              • SQLs should not be created by concatenating textual parameters from non-secure sources, such as parameters filled in by users or even stored in the database.<\/span><\/li>\n
                              • Access permissions to the database for application users must be restricted.<\/span><\/li>\n
                              • It is necessary, whenever possible, to pass parameters in SQL commands (DML or DDL) using prepared statements. Queries that cannot be parameterized should receive special treatment, such as escapes or hexadecimal coding.<\/span><\/li>\n
                              • HTML and Javascript injection attacks must be prevented.<\/span><\/li>\n
                              • Cross-site scripting (XSS) attacks should be prevented.<\/span><\/li>\n
                              • Broken Authentication and Session Management attacks must be prevented.<\/span><\/li>\n
                              • Systems must be subjected to intrusion testing tools.<\/span><\/li>\n<\/ul>\n

                                [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-6″ css=”.vc_custom_1598556811421{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″]

                                \n\t
                                \n\t\t
                                \n\t\t\t
                                \n\t
                                \n\t\t\t\t\t

                                \n\t\t\t\t6 - AUDITING, TRACKING AND LOGS\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section presents guidelines for the maintenance of records\/logs for subsequent auditing, tracking and consultation of incidents related to system security. Each system has a different criticality in terms of data access restriction, non-repudiation and history of operations carried out in the database. For this reason, this section does not define what information should be audited, but rather suggests possible items that can be audited, tracked or logged. These items, then, must be evaluated by product managers.<\/span><\/p>\n

                                 <\/p>\n

                                6.1 Examples of events that can be logged:<\/b><\/p>\n

                                  \n
                                • Login and logout operations;<\/span><\/li>\n
                                • Access to certain screens or sections of the system;<\/span><\/li>\n
                                • Access to information with some restrictions (For example: confidential documents, personal data);<\/span><\/li>\n
                                • Operations for the inclusion, alteration or deletion of records in the database;<\/span><\/li>\n
                                • Change of access profile (for systems that have access with different profiles);<\/span><\/li>\n
                                • Execution of jobs and automated tasks.<\/span><\/li>\n<\/ul>\n

                                  6.2 Examples of information that can be stored, related to each event:<\/b><\/p>\n

                                    \n
                                  • Date and time;\u00a0<\/span><\/li>\n
                                  • User who performed the operation;<\/span><\/li>\n
                                  • IP address;<\/span><\/li>\n
                                  • User session identifier (when applicable, for example: cookies);<\/span><\/li>\n
                                  • Screen (page) of the system in which the operation was performed;<\/span><\/li>\n
                                  • Instance identifier (for clustered systems);<\/span><\/li>\n
                                  • For insertion, alteration or deletion operations, the type of operation, name of the table that was manipulated, record ID and, if applicable, previous and current values for each field;<\/span><\/li>\n
                                  • Parameters informed by the user (Examples: GET or POST parameters), being careful not to store Sensitive Personal Data, such as passwords;<\/span><\/li>\n
                                  • System response time;<\/span><\/li>\n
                                  • To execute jobs and automated tasks, store the result of the operation; failure, success, cancelation, etc.<\/span><\/li>\n<\/ul>\n

                                    [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-7″ css=”.vc_custom_1598556879259{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″]

                                    \n\t
                                    \n\t\t
                                    \n\t\t\t
                                    \n\t
                                    \n\t\t\t\t\t

                                    \n\t\t\t\t7 - PREVENTION, REACTION AND MITIGATION OF SECURITY BREACHES\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section presents guidelines for carrying out procedures that guarantee an adequate reaction to the occurrence of security breaches. The use of backups, tests and event handling is detailed below.<\/span><\/p>\n

                                     <\/p>\n

                                    7.1 Backups<\/b><\/p>\n

                                      \n
                                    • The specification of the need and the assignment of the responsibility for making backups of the database and of the system source codes, as well as the access policies for this backup, must be included in the project plan.<\/span><\/li>\n
                                    • A structured procedure for restoring backups must be defined.<\/span><\/li>\n
                                    • Personnel in charge of the recovery of backups must be properly designated and trained.<\/span><\/li>\n
                                    • Baselines of the system versions must be created, facilitating the agile recovery to a previous version.<\/span><\/li>\n
                                    • Simulation of data restoration must be carried out continuously.<\/span><\/li>\n<\/ul>\n

                                       <\/p>\n

                                      7.2 Tests<\/b><\/p>\n

                                        \n
                                      • Manual security tests must be carried out before each version of the software that changes its structure (login screens, unauthenticated services, new forms with user interaction, etc.).<\/span><\/li>\n
                                      • It must be ensured, through automated tests, that the services and confidential data are protected and available only to the users who hold the information.<\/span><\/li>\n
                                      • A specific testing policy must be developed, whether automated or not, aiming at guaranteeing non-vulnerability to the main known attacks on systems.<\/span><\/li>\n
                                      • Test scenarios should be defined to guarantee the non-functional software requirements, preferably carried out by a test team different from the software development team, in order to avoid bias.<\/span><\/li>\n
                                      • Test scenarios should be defined, mainly in terms of security, for cases of updates to the system architecture (application servers, database, browser versions, operating system versions, etc.).<\/span><\/li>\n<\/ul>\n

                                         <\/p>\n

                                        7.3 \u00a0Incidents<\/b><\/p>\n

                                          \n
                                        • A planned procedure must be maintained for immediate system unavailability and corrective maintenance.<\/span><\/li>\n
                                        • A specific policy to foster the follow-up on security breach incident response must be defined.<\/span><\/li>\n
                                        • Lessons learned from past incidents should be used to review the testing policy and increase system security.<\/span><\/li>\n<\/ul>\n

                                          [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-8″ css=”.vc_custom_1598556985893{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″]

                                          \n\t
                                          \n\t\t
                                          \n\t\t\t
                                          \n\t
                                          \n\t\t\t\t\t

                                          \n\t\t\t\t8 - DEVELOPMENT ENVIRONMENT\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section provides guidelines for installing, configuring and managing system development environments.<\/span><\/p>\n

                                           <\/p>\n

                                          8.1 Source Code Access <\/b><\/p>\n

                                            \n
                                          • A version control system with access control and recovery in case of failures must be used. (For example: Microsoft Team Foundation Server).<\/span><\/li>\n<\/ul>\n

                                             <\/p>\n

                                            8.2 Separation of Environments<\/b><\/p>\n

                                              \n
                                            • The Development\/Testing\/Homologation environments must be separated from the Production environment.<\/span><\/li>\n
                                            • Different databases must be used for each environment.<\/span><\/li>\n
                                            • Different application\/web servers must be used for each environment.<\/span><\/li>\n
                                            • Access to the Development\/Testing\/Homologation environment should only be provided to members of the development team and to those interested in the project (stakeholders).<\/span><\/li>\n
                                            • Periodic tests must be carried out to ensure the security of the development\/testing\/homologation environment.<\/span><\/li>\n
                                            • Developers should not be provided with passwords to access the production environment.<\/span><\/li>\n
                                            • <\/li>\n<\/ul>\n

                                              [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-9″ css=”.vc_custom_1598557107463{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″]

                                              \n\t
                                              \n\t\t
                                              \n\t\t\t
                                              \n\t
                                              \n\t\t\t\t\t

                                              \n\t\t\t\t9 - DATA PROTECTION\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section provides guidelines for configuring Sensitive Personal Data protection. Parameters for encryption, hashing and password management are detailed below.<\/span><\/p>\n

                                               <\/p>\n

                                              9.1 Cryptography and Hashing<\/b><\/p>\n

                                                \n
                                              • A cryptographic method that follows the Kerckhoffs’ Principle should be used. The encryption method and its parameters must be public and documented, only the cryptographic key must be kept confidential.<\/span><\/li>\n
                                              • An encryption that admits a known method for breaking the cryptographic key (brute force), based on trial and error, should not be used.<\/span><\/li>\n
                                              • Electronic codebook (ECB) block encryption mode or less secure modes should not be used.\u00a0<\/span><\/li>\n
                                              • A key size of less than 128 bits (symmetric encryption) or 1024 bits (asymmetric encryption) should not be used.<\/span><\/li>\n
                                              • The hash function should not be used without some type of salt.<\/span><\/li>\n
                                              • Algorithms that are considered obsolete for cryptography and cryptographic hashing should not be used. Examples: MD5, SHA1, DES\/3DES, RC2, RC4, MD4.<\/span><\/li>\n
                                              • A key size of less than 192 bits (symmetric encryption) or 2048 bits (asymmetric encryption) should not be used.<\/span><\/li>\n
                                              • Cryptographic keys should not be distributed without the use of a public key infrastructure and, therefore, without the use of asymmetric encryption.<\/span><\/li>\n
                                              • A key size of less than 256 bits (symmetric encryption) or 4096 bits (asymmetric encryption) should not be used.<\/span><\/li>\n<\/ul>\n

                                                 <\/p>\n

                                                9.2 Passwords<\/b><\/p>\n

                                                  \n
                                                • Password size:<\/b> Passwords with less than 6 characters should not be used.<\/span><\/li>\n
                                                • Variation of symbols: <\/b>At least upper and lower case letters must be used, together with at least one type of character (digit, symbol).<\/span><\/li>\n
                                                • Randomness:<\/b> Passwords should not be created without the aid of random password generator software, configured to meet the parameters established below:<\/span><\/li>\n
                                                • Tests:<\/b> You should not use a password that has not been validated by password strength checker software.<\/span><\/li>\n
                                                • Change frequency:<\/b> Same passwords should not be used for more than 6 months.<\/span><\/li>\n
                                                • Password change and recovery:<\/b> The use of the same password validation channel should not be allowed. The old password should not be sent to users, under no circumstances.<\/span><\/li>\n
                                                • Storage (user):<\/b> You should not store a password that is not encrypted following the standard level of encryption set out in this document.<\/span><\/li>\n
                                                • Number of attempts:<\/b> Password validation rate should not be allowed to exceed 5 attempts per minute. Passwords must be blocked in case of a maximum of 5 consecutive validation errors and its recovery must rely on a specific process.<\/span><\/li>\n<\/ul>\n

                                                  [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-10″ css=”.vc_custom_1598557164134{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″]

                                                  \n\t
                                                  \n\t\t
                                                  \n\t\t\t
                                                  \n\t
                                                  \n\t\t\t\t\t

                                                  \n\t\t\t\t10 - SOFTWARE LIFE CYCLE\t\t\t<\/h4>\n\t\t\t\t\t<\/div>\n<\/div>[vc_column_text]This section presents guidelines for enhancing software security at different stages of its life cycle; design, coding and maintenance. It also provides guidelines for application with those involved in the different phases.<\/span><\/p>\n

                                                   <\/p>\n

                                                  10.1 Design<\/b><\/p>\n

                                                    \n
                                                  • The software design model should include the following:<\/span>\n
                                                      \n
                                                    • Threat modeling stage;<\/span><\/li>\n
                                                    • Clear definition of security risks;<\/span><\/li>\n
                                                    • Severity level that the compromise of Sensitive Personal Data would bring to the system and institution.<\/span><\/li>\n<\/ul>\n<\/li>\n
                                                    • It should not be omitted, during the system development design and its execution, the definition of responsibilities for system data security and how this responsibility will be verified.\u00a0<\/span><\/li>\n
                                                    • A design schedule that includes security check points of the system developed during its construction must be used.<\/span><\/li>\n<\/ul>\n

                                                       <\/p>\n

                                                      10.2 Coding<\/b><\/p>\n

                                                        \n
                                                      • Protective measures applied in the source code must be documented, including in the application code, in order to indicate precisely the procedure used and its peculiarities.<\/span><\/li>\n<\/ul>\n

                                                         <\/p>\n

                                                        10.3 Maintenance<\/b><\/p>\n

                                                          \n
                                                        • Automatic updates of software or components used in the construction of a system should not be enabled, otherwise security breaches may, inadvertently, come up.<\/span><\/li>\n
                                                        • Third party software should not be modified, except when strictly necessary. Internal security controls can be invalidated. This change should be made by the original system developer whenever possible.<\/span><\/li>\n<\/ul>\n

                                                           <\/p>\n

                                                          10.4 Personnel <\/b><\/p>\n

                                                            \n
                                                          • Training and qualification of programmers should be provided for the acquisition and review of computer security principles and the development of secure software.<\/span><\/li>\n<\/ul>\n

                                                            [\/vc_column_text]\t\t<\/div>\n\t<\/div>\n<\/div><\/div>[\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row]<\/p>\n<\/section>","protected":false},"excerpt":{"rendered":"

                                                            [vc_row el_id=”policy-section-summary”][vc_column width=”3\/12″][vc_raw_html]JTVCY2Etc2lkZWJhciUyMGlkJTNEJTIyMTg1ODYlMjIlNUQ=[\/vc_raw_html][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-1″ css=”.vc_custom_1598555296159{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-2″ css=”.vc_custom_1598555405295{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-3″ css=”.vc_custom_1598555420662{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-4″ css=”.vc_custom_1598555756427{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-5″ css=”.vc_custom_1598556699767{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-23824","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"\r\nSecure Software Development Policy - Epimed Solutions<\/title>\r\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\r\n<link rel=\"canonical\" href=\"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/\" \/>\r\n<meta property=\"og:locale\" content=\"en_US\" \/>\r\n<meta property=\"og:type\" content=\"article\" \/>\r\n<meta property=\"og:title\" content=\"Secure Software Development Policy - Epimed Solutions\" \/>\r\n<meta property=\"og:description\" content=\"[vc_row el_id=”policy-section-summary”][vc_column width=”3\/12″][vc_raw_html]JTVCY2Etc2lkZWJhciUyMGlkJTNEJTIyMTg1ODYlMjIlNUQ=[\/vc_raw_html][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-1″ css=”.vc_custom_1598555296159{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-2″ css=”.vc_custom_1598555405295{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-3″ css=”.vc_custom_1598555420662{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-4″ css=”.vc_custom_1598555756427{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-5″ css=”.vc_custom_1598556699767{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row […]\" \/>\r\n<meta property=\"og:url\" content=\"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/\" \/>\r\n<meta property=\"og:site_name\" content=\"Epimed Solutions\" \/>\r\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/epimed\/\" \/>\r\n<meta property=\"article:modified_time\" content=\"2021-11-11T10:50:53+00:00\" \/>\r\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\r\n<meta name=\"twitter:site\" content=\"@epimed\" \/>\r\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"11 minutes\" \/>\r\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/\",\"url\":\"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/\",\"name\":\"Secure Software Development Policy - Epimed Solutions\",\"isPartOf\":{\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/#website\"},\"datePublished\":\"2020-08-27T20:07:04+00:00\",\"dateModified\":\"2021-11-11T10:50:53+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"In\u00edcio\",\"item\":\"https:\/\/www.epimedsolutions.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Secure Software Development Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/#website\",\"url\":\"https:\/\/www.epimedsolutions.com\/en\/\",\"name\":\"Epimed Solutions\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.epimedsolutions.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/#organization\",\"name\":\"Epimed Solutions\",\"url\":\"https:\/\/www.epimedsolutions.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/epimedsolutions.com\/wp-content\/uploads\/2020\/04\/logo-epimed-1.png\",\"contentUrl\":\"https:\/\/epimedsolutions.com\/wp-content\/uploads\/2020\/04\/logo-epimed-1.png\",\"width\":400,\"height\":193,\"caption\":\"Epimed Solutions\"},\"image\":{\"@id\":\"https:\/\/www.epimedsolutions.com\/en\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/epimed\/\",\"https:\/\/x.com\/epimed\",\"https:\/\/www.instagram.com\/epimedsolutions\/\",\"https:\/\/www.youtube.com\/user\/epimedsolutions\/\"]}]}<\/script>\r\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Secure Software Development Policy - Epimed Solutions","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/","og_locale":"en_US","og_type":"article","og_title":"Secure Software Development Policy - Epimed Solutions","og_description":"[vc_row el_id=”policy-section-summary”][vc_column width=”3\/12″][vc_raw_html]JTVCY2Etc2lkZWJhciUyMGlkJTNEJTIyMTg1ODYlMjIlNUQ=[\/vc_raw_html][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-1″ css=”.vc_custom_1598555296159{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-2″ css=”.vc_custom_1598555405295{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-3″ css=”.vc_custom_1598555420662{padding-top: 25px !important;}”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-4″ css=”.vc_custom_1598555756427{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row el_id=”policy-section-5″ css=”.vc_custom_1598556699767{padding-top: 25px !important;}”][vc_column width=”3\/12″][\/vc_column][vc_column width=”7\/12″][\/vc_column][vc_column width=”2\/12″][\/vc_column][\/vc_row][vc_row […]","og_url":"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/","og_site_name":"Epimed Solutions","article_publisher":"https:\/\/www.facebook.com\/epimed\/","article_modified_time":"2021-11-11T10:50:53+00:00","twitter_card":"summary_large_image","twitter_site":"@epimed","twitter_misc":{"Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/","url":"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/","name":"Secure Software Development Policy - Epimed Solutions","isPartOf":{"@id":"https:\/\/www.epimedsolutions.com\/en\/#website"},"datePublished":"2020-08-27T20:07:04+00:00","dateModified":"2021-11-11T10:50:53+00:00","breadcrumb":{"@id":"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.epimedsolutions.com\/en\/secure-software-development-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"In\u00edcio","item":"https:\/\/www.epimedsolutions.com\/en\/"},{"@type":"ListItem","position":2,"name":"Secure Software Development Policy"}]},{"@type":"WebSite","@id":"https:\/\/www.epimedsolutions.com\/en\/#website","url":"https:\/\/www.epimedsolutions.com\/en\/","name":"Epimed Solutions","description":"","publisher":{"@id":"https:\/\/www.epimedsolutions.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.epimedsolutions.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.epimedsolutions.com\/en\/#organization","name":"Epimed Solutions","url":"https:\/\/www.epimedsolutions.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.epimedsolutions.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/epimedsolutions.com\/wp-content\/uploads\/2020\/04\/logo-epimed-1.png","contentUrl":"https:\/\/epimedsolutions.com\/wp-content\/uploads\/2020\/04\/logo-epimed-1.png","width":400,"height":193,"caption":"Epimed Solutions"},"image":{"@id":"https:\/\/www.epimedsolutions.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/epimed\/","https:\/\/x.com\/epimed","https:\/\/www.instagram.com\/epimedsolutions\/","https:\/\/www.youtube.com\/user\/epimedsolutions\/"]}]}},"_links":{"self":[{"href":"https:\/\/www.epimedsolutions.com\/en\/wp-json\/wp\/v2\/pages\/23824","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.epimedsolutions.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.epimedsolutions.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.epimedsolutions.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.epimedsolutions.com\/en\/wp-json\/wp\/v2\/comments?post=23824"}],"version-history":[{"count":0,"href":"https:\/\/www.epimedsolutions.com\/en\/wp-json\/wp\/v2\/pages\/23824\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.epimedsolutions.com\/en\/wp-json\/wp\/v2\/media?parent=23824"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}