An organization should define its own security assessment policies for every release. For a major or new application release, there is no doubt that a full security assessment is needed. However, should we do the same for a patch release, especially when it's a time-sensitive and business-critical release? Having a clear understanding of the application release scope and objective will help the security team to plan the necessary security assessment scope.
The following table shows an example of the relationship between the application releases and the security assessment scope:
|
Application release objective |
Security assessment scope |
|
New or major application release |
Full assessment |
|
Third-party component update |
Assessment based on the third party and the integration interfaces |
|
Patch releases |
Targeted assessment... |