ISO/IEC 27034-7:2018 情報技術—アプリケーションセキュリティ—パート7：保証予測フレームワーク | ページ 6

3.1

prediction

statement or estimate that a specific thing will happen in the future or will be a consequence of something

Note 1 to entry: The origin of the word is early 17th century: from Latin praedict-“made known beforehand, declared”, from the verb praedicere from prae-“beforehand” + dicere “say”.

Note 2 to entry: The use in this document reflects the expectation that, if the security and verification measurement activities are executed, they will match the results from the original application.

3.2

prediction framework

process that performs a risk analysis, establishes an Expected Level of Trust (3.8) , assigns Application Security Control verification to a PASR (3.7) , and then creates an Expected Level of Trust Report (3.9)

3.3

original application

application that establishes the baseline Actual Level of Trust

Note 1 to entry: The original application is not necessarily version 1.0 and, hence, can have an associated Expected Level of Trust.

3.4

subsequent application

application related to the original application (3.3) through versioning

3.5

predictive security

transfer of confidence in the security claims (3.6) of the original application (3.3) to the security claims of the subsequent application (3.4)

3.6

security claim

specific claim that security properties are present in an application

Note 1 to entry: Under the ISO/IEC 27034 frameworks (all parts), it is the claim that the activities specified by an Application Security Control mitigate specific security risks to an acceptable level.

Note 2 to entry: In the context of a PASR, it is the claim that verification of the Application Security Control activities, which were predicted by the PASR, would produce the same results as if the Application Security Control activities were performed.

3.7

Prediction Application Security Rationale

PASR

rationale for a prediction (3.1) , supported by risk analysis documents, approved by the application owner, explaining that performing the verification activities of a specific Application Security Control is not necessary

Note 1 to entry: Use of PASR requires approval of both application owner and the inclusion of the PASR guidelines in the Application Security Control by the Organization Normative Framework Committee.

3.8

Expected Level of Trust

level of trust, defined in the Organization Normative Framework ここで, the activities of some of the Application Security Controls are satisfied through the creation of a PASR (3.7)

Note 1 to entry: This document describes the minimum requirements applicable to the Application Security Controls used in an Expected Level of Trust for a subsequent application (3.4) . In the context of an Expected Level of Trust, there is always an original application (3.3) where the project team performed the activities of the indicated Application Security Controls.

3.9

Expected Level of Trust Report

document presenting and supporting the risk analysis in support of predictions (3.1) made for a subsequent application

3.10

predicted Application Security Control

predicted ASC

Application Security Control in which security activities are replaced by a PASR (3.7)

3.11

prediction consumer

anyone that relies on an Expected Level of Trust (3.8)

Note 1 to entry: Mainly application consumers, application acquirers, and application owners.

3.12

prediction initiator

entity that selects an Expected Level of Trust (3.8) for an application

Note 1 to entry: Typically, the project team with approval by the application owner.

3.13

verification measurement

activity provided by an Application Security Control to verify if its security activity was correctly implemented and works as expected by producing required evidence/outcomes

3.14

substantial change

change that causes sufficient impact to the risk assessment so that the application owner no longer permits predicted Application Security Controls (3.10) , resulting in the project team performing the necessary Application Security Control activities in the Actual Level of Trust

3.15

regression testing

testing required to determine that a change to a system component has not adversely affected functionality, reliability or performance and has not introduced additional defects