At least one tester must be designated to test for security flaws in addition to functional testing.
An XCCDF Rule
Description
<VulnDiscussion>If there is no person designated to test for security flaws, vulnerabilities can potentially be missed during testing. This requirement is meant to apply to developers or organizations that are doing development work.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-222646r961863_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Designate personnel to conduct security testing on the applications.