Verificando autenticación…

Skip to main content

Secure Software Development Norm

Code: GRT.NOR.0062 · Version: 2.6 · Type: Norm

Establishes the mandatory security guidelines for developing software in a controlled and secure environment, avoiding common vulnerabilities and ensuring the confidentiality, integrity, and availability of information.

Scope​

All software development carried out internally by Grupo LATAM staff or contracted third parties: web and mobile applications, microservices, APIs, and automation scripts, from development through operational handover.

Key points​

Pre-development considerations​

  • Adopt Security by Design from the earliest lifecycle phases.
  • Prioritize prevention over vulnerability detection.
  • Participation of the Security Chapter and Architecture in all project phases.
  • Environment separation (development, testing, production) with no unauthorized cross-access and role separation.
  • Do not use production data (or sensitive data) for internal or third-party testing.
  • Use LATAM-validated and standardized templates and go through the change control cycle.

Minimum security requirements​

  • Secure programming standard based on OWASP and OWASP Top 10 LLM (AI).
  • Architecture built on the LATAM technology stack and approved by Information Security.
  • Authentication and authorization integrated with SSO and MFA (Azure AD / Google SSO), with encrypted authentication traffic.
  • Credential management: no plaintext or hardcoded secrets; service accounts per environment; key rotation; encrypted storage.
  • Encrypted transmission of confidential, restricted, and personal data; every application must generate logs.

Security in development​

  • Error handling: do not expose sensitive data or error traces to the end user; restrict log access.
  • Session management: effective logout, short timeout, no concurrent logins with the same ID, random identifiers.
  • Personal data: minimization, anonymization, rectification/deletion capabilities, and "Privacy by Design".
  • Validation of input, output, and processed data before reaching production.

Training and production rollout​

  • Mandatory secure development training (OWASP, NIST, PCI-DSS, OWASP Top 10 LLM).
  • Applications on Kubernetes / Cloud Run: code verification (Sonar, Checkmarx) and deployment through the pipeline.

Compliance procedures​

  • DOR/DOD checklist for each initiative.
  • Health reports via SAST/DAST scanning.
  • Sanity index in Panel 360.
Full document

This summary captures the main points. Refer to the official, complete version of the norm:

→ Secure Software Development Norm (GRT.NOR.0062)