Here you will find all tactics for the quality characteristic Security.
Confidentiality
Encryption
Encrypt data during transmission and storage
Here you will find all tactics for the quality characteristic Security.
Confidentiality
Encrypt data during transmission and storage
Authenticity
Verify the identity of users and systems
Authenticity, Integrity
Verify identity using two independent factors
Integrity, Confidentiality
Control access to resources based on permissions
Confidentiality
Also supports: Integrity, Analyzability
Define access rules for critical data and functions
Confidentiality
Also supports: Analyzability
Control access to application components based on roles
Integrity
Also supports: Availability
Equip users and processes with only the minimal necessary rights
Accountability
Log and monitor security-related events
Integrity
Validate all inputs from users and external systems
Authenticity, Integrity
Manage sessions based on random, time-limited ids
Integrity
Also supports: Availability
Deliver and operate systems with secure default settings
Confidentiality
Promote secure software design through exchange with experts and peers
Integrity, Confidentiality
Also supports: Availability
Define mandatory rules for the secure usage of applications
Integrity
Also supports: Availability
Define mandatory rules for secure software development
Integrity, Confidentiality
Also supports: Availability
Provide structured, role-specific courses that build deep security expertise
Integrity, Confidentiality
Also supports: Availability
Deliver continuous lightweight nudges that keep security top-of-mind
Integrity
Also supports: Availability
Divide the network into security zones with separate trust levels
Integrity
Also supports: Availability
Establish security as an integral part of the development process
Integrity
Also supports: Availability
Consider security already in the design of the architecture and implementation
Confidentiality, Integrity
Apply structured frameworks to assess and mitigate security risks
Confidentiality, Integrity
Introduce a structured framework for assessing and improving security practices
Integrity, Confidentiality
Also supports: Availability
Regularly check systems and processes for security
Integrity, Confidentiality
Also supports: Availability
Identify, assess, and address security risks systematically
Integrity, Accountability
Also supports: Availability
Establish processes and tools for responding to security incidents
Integrity
Also supports: Availability
Ensure regular backup and recoverability of data
Integrity, Authenticity
Also supports: Availability
Use only secure and current versions of network protocols
Confidentiality
Also supports: Appropriateness, Correctness, Time-behaviour
Only collect and store personal data that is necessary for the purpose
Integrity, Confidentiality
Also supports: Availability
Verify security properties through specialized testing methods
Integrity
Also supports: Availability
Collect and analyze information about current threats and attacks
Integrity, Confidentiality
Also supports: Availability
Conduct comprehensive and realistic attacks on your own systems
Integrity
Also supports: Availability
Examine architecture and design for conceptual security gaps
Non-repudiation
Establish methods for investigating security incidents and crimes
Integrity
Also supports: Availability
Deploy specially secured decoy systems as bait for attackers
Integrity, Confidentiality
Also supports: Availability
Define, collect, and evaluate metrics to quantify the security status
Integrity, Confidentiality
Also supports: Availability
Conduct systematic analysis of threats, attackers, and countermeasures
Integrity, Confidentiality
Also supports: Availability
Describe undesirable use cases from an attacker's perspective
Integrity, Confidentiality
Also supports: Availability
Elicit and document specific requirements for information security
Integrity
Also supports: Availability
Align default settings and delivery state for maximum security
Integrity, Confidentiality
Also supports: Availability
Define boundaries between systems and components with different trust levels
Integrity, Confidentiality
Control and filter data flows between components and systems
Confidentiality, Integrity, Authenticity
Use proven and standardized algorithms and protocols for cryptographic functions
Confidentiality, Integrity, Authenticity
Establish procedures for the secure generation, distribution, and storage of cryptographic keys
Integrity
Also supports: Availability
Define mandatory rules and best practices for secure programming
Integrity
Also supports: Availability
Automatically check source code for programming errors and security vulnerabilities
Integrity
Also supports: Availability
Test security properties by executing and observing program behavior
Integrity
Also supports: Availability
Use libraries and frameworks with built-in security features
Integrity
Also supports: Availability
Use parameterized queries to prevent SQL injection
Integrity
Also supports: Availability
Mask outputs to prevent injection attacks
Integrity
Also supports: Availability
Transform input data into a canonical representation
Integrity
Also supports: Availability
Feed randomly generated input data to expose unexpected behavior
Integrity
Also supports: Availability
Deliberately test invalid inputs and edge cases to check error handling
Integrity
Also supports: Confidentiality, Non-repudiation
Retest previously fixed security vulnerabilities to prevent their recurrence
Integrity, Confidentiality
Also supports: Availability
Engage independent security experts to test the application
Integrity, Confidentiality
Also supports: Availability
Uncover security vulnerabilities through simulated attacks
Integrity, Confidentiality
Also supports: Availability
Improve the security state of systems and components
Integrity, Confidentiality
Also supports: Availability
Apply security updates and patches promptly
Integrity, Confidentiality
Also supports: Availability
Implement security mechanisms in multiple layers and levels
Integrity
Also supports: Availability
Detect and defend against malware through technical measures
Accountability
Also supports: Availability
Continuously capture and analyze security-relevant events and data
Integrity
Also supports: Non-repudiation, Authenticity
Monitor endpoints continuously for threats in real-time
Integrity
Also supports: Availability
Regularly check systems and applications for known vulnerabilities
Integrity
Also supports: Availability
Regularly review dependencies on external software
Integrity, Accountability
Also supports: Availability
Document and regularly review security-relevant settings
Integrity
Also supports: Availability
Train incident response behavior and test emergency processes
Confidentiality
Also supports: Availability
Protect IT infrastructure through structural and organizational measures
Integrity, Confidentiality
Also supports: Availability
Embed security as a shared value within the organization
Confidentiality, Authenticity
Also supports: Integrity
Verify every request regardless of origin or network location
Confidentiality, Integrity
Also supports: Authenticity
Secure APIs through rate limiting, schema validation, and authentication
Confidentiality, Integrity
Manage application secrets using dedicated vaults and rotation policies
Authenticity, Integrity
Also supports: Non-repudiation
Manage X.509 certificate lifecycles including revocation and pinning
Non-repudiation, Integrity
Also supports: Authenticity
Apply cryptographic signatures for code signing and document verification
Authenticity
Also supports: Accountability
Delegate authentication to trusted external identity providers
Confidentiality
Also supports: Accountability
Embed privacy protection into system architecture from inception
Integrity, Confidentiality
Also supports: Availability
Filter HTTP traffic at the application layer against web attacks
Integrity, Authenticity
Secure the software supply chain through SBOMs and provenance checks
Non-repudiation, Accountability
Maintain tamper-proof, cryptographically chained audit records