Verificando autenticación…

Skip to main content

Secure Coding Standard

Code: GRT.EST.010 · Version: 2.5 · Type: Standard

Defines the general guidelines and S-SDLC standards of LATAM for the secure construction of systems, accounting for applicable regulations (GDPR, LGPD, PCI-DSS, SOX) from the design stage.

Scope​

Applicable to all employees, collaborators, third parties, processes, and system components of Grupo LATAM.

Responsibilities​

  • Security Architect (Cybersecurity): ensures compliance with the standards and reviews this standard.
  • Engineering Platform (Delivery / Resources / Developer): secure deployments and IaC, up-to-date libraries and frameworks.
  • Squad Developers: confirm adherence to the standard, report violations, and provide evidence of LATAM's secure development course.

Key points​

Strategic guidelines​

  • Cloud-oriented (GCP) with cloud-native components; IaaS/PaaS only by validated exception.
  • Priority to SaaS services (with provider DoR/DoD and VCR assessment).
  • Authentication + 2FA/MFA integrated with SSO, preferably Entra ID (Azure AD).
  • Formal process with a mandatory collaborative design instance (architecture, infrastructure, and security architecture).
  • Regulatory compliance based on the data handled: PCI, SOX, GDPR, LGPD.

Controls by domain (DoR / DoD)​

During design, implemented controls are reviewed; the DoR verifies commitments and the DoD validates that development meets them.

  • Networks & Endpoint Security: DDoS protection (WAF Akamai, Cloud Armor), single egress via NAT, ingress via load balancer, TLS 1.2+ with a Restricted SSL policy, security agents (Qualys, Prisma, CrowdStrike), production access only with service accounts.
  • Application Security: security testing during development, mandatory OWASP ASVS 4.0.3, Cloud Endpoints, API protection in Akamai, mandatory CI/CD with GitLab, reCAPTCHA on logins/forms without SSO, no plaintext links in emails.
  • Data: regulatory compliance (SOX, GDPR, LGPD, PCI), KMS / Secret Manager for sensitive information, encryption in transit, minimization/masking outside production, PII protection, card numbers forbidden in logs.
  • Digital Identity: Azure AD (priority) and Google SAML 2.0, profiling, least privilege, ABM process, segregation of duties, 2FA/MFA.
  • Logging: Google Cloud operations suite; logs with IP, port, accesses, user ID, and date; never sensitive data.
  • Governance: takeover with Identity Management, domain ownership, provider contract and NDA, SOX controls, and project formality (Jira ticket, evidence).

PCI requirements​

  • Evidence of a secure development course and use of OWASP ASVS.
  • PCI-DSS 4.0.1 compliance (6.2.1 to 6.2.4): secure development, annual training, pre-production review, and techniques against common attacks.

AI requirements​

  • Validation and sanitization of AI model inputs.
  • Robust management of access keys to APIs/models.
  • Auditing and logging of AI interactions.
  • AI-specific security testing (penetration, model manipulation, data poisoning).
  • Measures against information leakage (anonymization, DLP, API security) and secure design principles.
Full document

This summary captures the main points. Refer to the official, complete version of the standard:

→ Secure Coding Standard (GRT.EST.010)