The New Zealand Transport Agency is open sourcing a security assurance tool it is developing with Wellington company Catalyst.
Catalyst has been working with NZTA to open source the tool that automates aspects of the security assurance process and embeds security requirements earlier in the product development life-cycle.
The Security Development Lifecycle Tool (SDLT), aligns with common government security classifications and risk assessment practices to deliver "security by design" across the agency's tech teams.
NZTA opted to open source the tool so other government agencies can similarly reduce their compliance overheads and focus on core delivery.
The source code is available on NZTA's GitHub repository.
The SDLT uses a series of questions to determine the complexity of the end product and will generate additional questionnaires such as privacy impact assessments or cloud risk assessments to help teams assess and record their security requirements.
It handles information gathering, task creation, workflow-management and business approvals. The tool also integrates with workflow management systems such as Jira and provides an audit trail that ensures security assurance has been built into project delivery.
It can be used to deliver or procure proof-of-concept products, software-as-a-service (SaaS) applications and to scope feature revisions or bug fixes.
The SDLT will enable NZTA to simplify the security assurance process, reduce spending on unnecessary third-party assessments and cut the product approval and delivery process from weeks to days.
Catalyst said it can install, host and support the SDLT for use by other organisations.