System and method for measuring and enforcing security policy compliance for software during the development process of the software

• US 7,930,727 B1
• Filed: 03/30/2006
• Issued: 04/19/2011
• Est. Priority Date: 03/30/2006
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Albertson, Jamie, Baize, Eric
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US11/393,396
• Time in Patent Office: 1,846 Days
• Field of Search: 726/1, 726/6
• US Class Current: 726/1
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method, computer program product, and apparatus for managing compliance to security policy by measuring it and enforcing security policy compliance based on the measurement for software under development.

Claims

1. A computer program product for managing compliance to security policy for software being developed, wherein the security policy is set and comprises one or more security requirements and the software is required to comply with the security policy, the computer program product including a computer-readable storage medium encoded with program logic for allowing the following computer-executable steps to occur:

(a) measuring compliance to the security policy by the software being developed, wherein measuring compliance includes checking for digital signatures, computer viruses, or trojan horses;

wherein the security policy enables security requirements for design, development, and quality assurance of the software being developed;

(b) creating a scorecard of the measured compliance of the software being developed to the one or more security requirements of the security policy in step (a); and

(c) using the scorecard created in step (b) to enforce the security policy by ensuring that the software being developed meets a predetermined level of compliance as measured by the scorecard including verifying compliance criteria for digital signatures, computer viruses, or trojan horses.

2. The computer program product of claim 1, wherein the computer-executed step (c) is followed by a step of refining product security requirements in order to enforce security policy by using the scorecard created in step (b).

3. The computer program product of claim 2, wherein the step of refining product security requirements in order to enforce security policy by using the scorecard created in step (b) is followed by a step of refining product development activity to further enforce security policy.

4. The computer program product of claim 3, wherein the step of refining product development activity to further enforce security policy is followed by a step of refining product quality assurance and testing in order to further enforce security policy.

5. The computer program product of claim 1, wherein the computer-executed step (c) is followed by a step of refining product development activity in order to enforce security policy by using the scorecard created in step (b).

6. The computer program product of claim 1, wherein the computer-executed step (d) is followed by a step of refining product quality assurance and testing in order to enforce security policy by using the scorecard created in step (b).

7. The computer product of claim 1 wherein the software is in the design, development, or quality assurance stage.