CISSP Practice Question (Domain 8: Software Development Security)

An insurer will replace its claims system with a small vendor's package in 60 days. The vendor keeps admin access for support and has never shown how it tests its code. No acquisition security requirements exist. What should the security manager do FIRST?

A. Require a current penetration test report from the vendor

B. Define acquisition security requirements and assess the vendor's development practices

C. Put the vendor's admin access behind a privileged access gateway

D. Scan the delivered package for vulnerabilities before deployment

(Explain your answer for more points in the comments!)

Come back for the answer tomorrow, or study more now!

6 comments

CISSP Practice Question (Domain 8: Software Development Security)