Android and iOS

NIST SSDF: placing RASP in secure development

OWASP, secure development and the evidence behind controls.

Standards and evidence1 min readEditorial methods

SSDF addresses security across the development lifecycle. A protection product can contribute a control but does not assume responsibility for source, supply chain or releases.

Evaluation approach

Define protection during design, version its settings, verify artifacts and monitor production effects. Be able to identify affected SDK releases and the person responsible for updates.

Application example

After an SDK upgrade, repeat critical-flow tests, review collection behavior and prepare rollback artifacts instead of checking compilation alone.

Limits and considerations

Referencing a framework does not prove that its activities happened. Written processes can differ from actual pipeline behavior.

Checks and decisions

  • Version protection settings
  • Maintain SDK inventories
  • Connect updates and vulnerability handling

Track prevention, verification and incident learning together. RASP does not replace vulnerability remediation.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.