📋ISO 27001 A.8.26high

Application security requirements

Description

Information security requirements shall be identified and specified when developing or acquiring applications.

⚠️ Risk Impact

Applications without security requirements are inherently insecure.

🔧 Remediation

Define security requirements for each application. Use EchelonGraph to verify configurations post-deployment.

💀 Real-World Attack Scenario

A product team built a customer-facing API without defining authentication requirements. The API launched with only API key authentication (no OAuth, no rate limiting, no input validation). Within 2 weeks, the API was exploited for mass data scraping, credential stuffing against other services, and SQL injection — affecting 50,000 customers.

💰 Cost of Non-Compliance

Applications without security requirements have 3x more vulnerabilities in production. Average cost of application vulnerability exploitation: $4.24M. ISO 27001 auditors require evidence of security requirements in application specifications.

📋 Audit Questions

  • 1.How are security requirements captured for new applications?
  • 2.What security standards must all applications meet?
  • 3.How are acquired/third-party applications assessed for security?
  • 4.Show security requirements in recent application specifications.

🎯 MITRE ATT&CK Mapping

T1190 — Exploit Public-Facing ApplicationT1059 — Command and Scripting Interpreter

⚡ Common Pitfalls

  • ⛔Security requirements defined but not verified post-deployment
  • ⛔One-size-fits-all security requirements that don't account for risk levels
  • ⛔Acquired applications exempted from security requirements

📈 Business Value

Defining security requirements upfront reduces remediation costs by 6x compared to fixing issues post-deployment. It's a key indicator of engineering maturity for enterprise buyers.

⏱️ Effort Estimate

Manual

4-8 hours per application to define and document security requirements

With EchelonGraph

EchelonGraph verifies infrastructure and configuration security requirements post-deployment

🔗 Cross-Framework References

SOC2-CC8.1NIST-SA-8

Automate ISO 27001 A.8.26 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →