Secure Software Assessment

HOW IT WORKS

This mini-assessment gives you direct insight in the current state of your Secure Software Development and provides you with suggestions to improve the security of your software development. The full assessment consists of an online survey on all elements of security.
This mini-assessment is based on our knowledge of and experience towards Secure Software Development and is a sneak preview of what to expect from our services in this domain.

If you like to know more about the Secure Software Assessment and/or our Secure Software approach, please don’t hesitate to contact us.

Assessment Security for CEO/Management Executives

1. Are you aware of the top security threats that you are up against? *

1. No, we have never been victim of security incidents. So far, so good

2. Our network security person handles security

3. We have a dedicated information security team that knows all the threats

4. We have a dedicated information security team; headed by the CISO (Chief Information Security Officer), that is responsible for categorizing threats, risk mitigation and other security processes

2. Do you work according to a leading information security management standard? *

1. We are not aware of any information security standard

2. We want to, but we are having troubles choosing which standards to use, therefore we are currently in a researching state

3. We have chosen an information security management system, but we do not know where and how to start

4. We work according to one of the standards (PCI-DSS, ISO 27001, HIPAA, etc.)

3. Is there a plan of action in place, in case of data breach? *

1. No, we were never hacked before and therefore have never needed a plan of action

2. No, we would be overthrown and would probably call for help in case of a data breach

3. We have an IT security team that would know how to respond

4. We have an incident response plan that comprises of an incident response team and of monitoring tools used to identify and respond to breaches

4. What does your software security assurance program look like? *

1. We are not aware of what a software security assurance program is

2. Upon releasing software we built, we do penetration testing for security

3. We do penetration testing on our applications every quarter and make sure that the identified threats are neutralized before User Acceptance Testing

4. Our software security assurance program ties with our software development lifecycle and we design and implement security controls along with the features that we are building

5. What kinds of initiatives are in place to educate people about security? *

1. We do not take any special effort in educating people about security. They already know

2. We train all our employees in information security as soon as they join the organization

3. We train software developers and IT administrators regularly in the latest threats and mitigation techniques so they can securely develop and maintain systems

4. Our information security team and the software security assurance group work with marketing and communication teams to design educational campaigns and events to increase and spread security awareness

6. What kinds of review and audit mechanisms are in place to ensure information security? *

1. We do not have any review and audit mechanisms in place for information security

2. We have security policies in place and sometimes our IT administrators work with the operations team to improve those policies

3. We have our IT security team reviewing and auditing our systems and policies regularly

4. We hire an external agency that reviews and audits our systems and policies regularly for compliance

7. Are you equipped with the cutting edge toolset to identify and counter security incidents? *

1. We have a firewall in place that prevents from any threats entering the organization

2. We have firewalls and Anti-Malware solutions installed on every device

3. We have firewalls and Anti-Malware solutions installed3. that are constantly updated and monitored for malicious incidents

4. We have firewalls with intrusion detection and prevention systems, Anti-Malware solutions with real-time monitoring, software and hardware asset monitoring tools, data loss prevention, security incident and event monitoring tools that and continuously being monitored and remediated by our information security team

8. How do you handle threats coming from contractors/vendors/partners? *

That’s a good question and quite frankly we don’t know yet, I think we trust them enough

2. We have non-disclosure agreements and confidentiality clauses signed with our vendors

3. We have some contractual guidelines about vendor management that we follow and we survey them on security yearly

4. We have a vendor management policy that includes procedures and tools and we continuously assess our vendors for adherence to our policies about how they handle our information in a secure way and we work with only the vendors that have a security management system in place

Are you aware of the General Data Protection Regulation? *

1. We do not know the General Data Protection Regulation

2. We heard that the penalties go up to 4% of annual global turnover or €20 Million (whichever is greater)

3. We are aware of General Data Protection Regulation and we are trying to figure out and improve processes and technology to improve protection of personal data

4. We are aware of General Data Protection Regulation, and our processes and tools are upgraded to comply with the legislation

View the results of this mini assessment and see where you can improve immediately.
Would you like to receive more information, or for example, a benchmark to discover your position compared to similar organizations? Then please get in touch!

Name

Email

Indien je een mens bent, laat dit veld leeg:.

NEED HELP?

Please contact us via our live chat or call us by phone:
+31 (0) 15-241 19 00.
We are more than happy to help you.