Research and assess security posture of technology solutions
Jump to: navigation, search      • Assess security risks in
third-party components.   • Determine how effective a technology
is likely to be at alleviating risks.     • Designer     • As
necessary.  Get structured technology assessment from vendor  If
a technology is to be integrated into your system - even if it
is for the purposes of mitigating risk in your own system - you
will generally assume the risks associated with that technology.
For this reason (among others), it is most desirable to assess
the security risks of such components in the same way as your
own software. Vendors are rarely cooperative in giving the
access required for this; and in cases where they are (e.g.,
open source software), the effort involved in a full assessment
is rarely cost-effective.  Instead, one will generally want to
collect relevant data that will provide insight into the likely
security posture of software through interaction with the
vendor. See CLASP Resou