BSI TR-03185 on the Secure Software Lifecycle
TR-03185 is a technical guideline from Germany's Federal Office for Information Security (BSI) on the secure software lifecycle. It is a national guideline, not an EU standard. It is still useful for manufacturers outside Germany. It groups requirements from existing standards around topics the Cyber Resilience Act also addresses: security in development and maintenance over the whole lifecycle. The BSI publishes it in English.
Software vulnerabilities increase the risk of cyberattacks, as the growing number of successful attacks on institutions such as hospitals and local authorities shows. The BSI registers around 70 new vulnerabilities in software products every day, and a growing share of them are rated critical. They often stem from insufficient attention to information security during development and from a lack of product maintenance.
The EU's Cyber Resilience Act (CRA) aims to improve the cybersecurity of IT products over their entire lifecycle and obliges manufacturers to meet corresponding security requirements. Against this background, the BSI developed TR-03185. It bundles the requirements of the BSI's IT-Grundschutz (its baseline protection methodology) and of other standards into one guideline for a secure software lifecycle.
Contents
Target groups and objectives
The guideline addresses both manufacturers of software (“software producers”) and manufacturers as users of software. In the guideline, manufacturers are natural or legal persons who develop, provide, and support software. Users, by contrast, use software to support the software lifecycle. Both groups must consider the security requirements in their own area.
TR-03185 has the following objectives:
- list and group requirements from existing standards,
- introduce the topic of the secure software lifecycle,
- present the relevant requirements in the context of information security, and
- assess and improve the software lifecycle with regard to information security.
Processes and requirements
The guideline covers processes and tools in the context of software development. It distinguishes between requirements for the manufacturer as a producer of software and requirements for the manufacturer as a user of software.
Software users
The requirements for the manufacturer as a user of standard software concern the tools that support the software lifecycle and are used in the software producer's processes. They are divided into:
- Project management: defining and documenting the requirements for software tools, selecting suitable tools, and procuring and operating them securely.
- Documentation: creating and maintaining documentation on the tools used and how they are applied.
- Testing and release: planning and carrying out tests to check the functionality and security of the software.
- Installation: installing and configuring software securely.
- Patch and change management: updating the software regularly and managing changes.
- Decommissioning: securely deleting the software and its data.
Software producers
The requirements for the manufacturer as a producer of software are divided into the following areas:
- Project management: defining and documenting the security requirements, choosing a suitable process model, and implementing a continual improvement process.
- Documentation: creating the project documentation and the user documentation.
- Development: secure design and implementation of the software, including threat modeling and testing during development.
- Testing: planning and carrying out thorough tests to ensure software quality.
- Delivery: ensuring the integrity and authenticity of the delivered software.
- Bug fixing and vulnerability management: procedures for handling security problems and vulnerabilities.
- Decommissioning: securely uninstalling the software and deleting its data.
Our assessment
We welcome the BSI's steps to promote secure software development. With TR-03185, the BSI provides a guideline that supports the systematic consideration of security requirements throughout the software lifecycle and so increases resilience against cyberattacks. The guideline has the potential to be widely applied and to considerably improve the security of software products in many areas.
