ASD ISM 2031 Secure system build tools implementation

The IT team should review the software development build tools currently in use.

They need to check if these tools have security features that can protect the software during the build process. Specific actions include researching documentation for any security options and settings in the compiler and enabling these features for active projects.

Software developers should regularly update their build tools and compilers.

By staying up to date, they ensure all recent security features and patches are included. This involves setting reminders for updates and subscribing to software announcements from the tools' providers to not miss important updates.

Managers overseeing software development projects should ensure that developers are aware of security features.

This could be done by organising training sessions or workshops about using security features within development tools effectively. Include practical examples specific to their ongoing projects to enhance understanding.

System owners should collaborate with the IT security team to conduct regular security audits of the software build process.

Schedule periodic checks where the build configuration is reviewed to make sure security features are enabled and functioning as expected. Document the findings and actions taken for future reference.

Procurement teams should include security feature checks as a criterion when purchasing new build tools.

This means ensuring that any new tools have robust security capabilities and are capable of integrating with existing security measures. Engage with vendors to provide demonstrations or trial versions to evaluate the security features before purchase.