Secure Application Development Lifecycle

[Applicable to MP, OSP, and AP]
The following best practices should be followed when implementing a secure SDLC:
1. Secure SDLC Governance: A security governance framework should be implemented that is tailored to the secure SDLC and that defines roles, responsibilities, and accountability for security throughout the secure SDLC
i. The AI Service Providers (e.g., CSP, MP, OSP, or AP) secure SDLC processes, at a minimum, should meet the regulatory and AIC’s business requirements.
ii.  The AISP should provide information to AISCs about the secure SDLC processes to the extent compatible with their disclosure policies.

2. Threat Modeling: AI-specific threat modeling should be incorporated into the early stages of the secure SDLC to identify potential security risks (e.g., poisoning, model inversion, data leakage).
Mitigation strategies should be designed to help developers anticipate and proactively address AI-specific security issues, reducing the likelihood of AI-specific vulnerabilities being introduced later in the development cycle.

3. Secure Coding Practices:
i. Comprehensive security design requirements should be defined that specify AI-specific security measures and controls to be implemented throughout the application's architecture
ii. Industry standard (e.g., OWASP, etc) secure coding practices should be incorporated in the secure SDLC
iii. Secure coding guidelines should be followed and implemented respectively (e.g., proper implementation and configuration of security headers, input validation, information output handling, error handling, and proper use of cryptographic libraries)
iv. Conduct regular training to ensure awareness and adherence to secure coding practices

4. Open-Source Components Secure Use: Secure practices for managing open-source components should be employed, including thorough vulnerability scanning, dependency management, and continuous monitoring for known vulnerabilities. Use trusted open-source repositories and ensure proper attribution and licensing compliance.

5. Vulnerability Management: Continuously scan for and remediate vulnerabilities in code, infrastructure, and third-party components (refer to TVM domain)

6. Security Testing: Regular security audits, static and dynamic application security testing, and penetration testing should be conducted to identify and address potential security weaknesses (refer to AIS-05 and TVM-06).

7. Secure Deployment and Configuration Management: (i) Secure deployment and configuration management practices should be implemented to ensure that AI applications are deployed and configured in a secure manner (ii)Automated tools should be used to enforce consistent configurations and monitor for deviations from security policies.

8. AI Impact Assessment: AI Impact Assessments should be conducted following the standards in GRC-10. Assessments should be updated at key SDLC stages and after major changes.

1. Policy Examination: Verify the following: a documented SDLC process exists; the SDLC process explicitly includes all key phases: design, development, deployment, and operations; this SDLC is approved and maintained under formal governance; and that the SDLC defines security roles and responsibilities throughout all phases.

2. Policy Assessment (regards content evaluation)
   a. Threat Modeling: Verify that the SDLC includes documented AI-specific threat modeling. If not present, assess whether a documented rationale and alternative risk mitigation strategy exists.
   b. Secure Coding Practices: Verify that the SDLC includes secure coding standards and guidance. If absent, evaluate documented justification and compensating controls.
   c. Open-Source Component Management: Verify whether the SDLC incorporates a documented program for managing open-source components, including vulnerability scanning and license compliance. If not, assess rationale and alternative practices.
   d. Vulnerability Management: Verify that the SDLC integrates vulnerability management processes for application code, infrastructure, and third-party components. If missing, confirm documented rationale and risk mitigation.
   e. Security Testing: Verify that the SDLC includes regular security testing, including AI-specific testing (e.g., adversarial testing, LLM-specific tests). If not conducted, assess rationale and compensating risk controls.
   f. Verify that the SDLC includes secure deployment pipelines, configuration hardening, and use of version-controlled, auditable configuration tools (e.g., IaC templates). Confirm separation of secrets from application code, use of secure variables, and role-based deployment permissions. Best practice is to assess if the SDLC is inline with best practice guidelines (e.g., OWASP).
   g. Secure Key and Secret Management: Verify that the SDLC explicitly defines secure key management practices, including: secure generation and storage (e.g., HSMs, KMS services); access control and audit logging for key use; regular key rotation, revocation, and recovery mechanisms; scoped usage policies (least privilege for tokens); avoidance of hardcoded keys or secrets in source code.

3. Software Development Lifecycle (SDLC) Evaluation: Evaluate whether the SDLC aligns with the organization’s documented security requirements and governance expectations, and confirm whether the SDLC considers applicable regulatory requirements (e.g., data protection, AI-specific regulations), and assess alignment with those obligations.

4. Implementation Validation: Validate actual implementation of the SDLC by reviewing supporting documentation and corroborating with operational evidence (e.g., staff interviews, ticketing system analysis), and inspect sample implementation artifacts to verify completeness and accuracy of practices, such as: documented threat models; code samples showing secure coding techniques; evidence of open-source component governance (e.g., SBOMs, SCA reports); vulnerability scanning reports, remediation tickets, and patch evidence; logs or reports from security testing tools (e.g., SAST, DAST, IAST, penetration tests); secure deployment evidence (e.g., IaC templates, CI/CD security gates, monitoring alerts).

From CCM:
1. Examine policy and procedures for definition of SDLC, security, and compliance requirements.
2. Examine the state of implementation of the SDLC process.
3. Verify that the SDLC implementation is in accordance with requirements.