6.2.3: Bespoke and custom software is reviewed prior to being released into production or to customers, to identify and correct potential coding vulnerabilities, as follows:

• Code reviews ensure code is developed according to secure coding guidelines.
• Code reviews look for both existing and emerging software vulnerabilities.
• Appropriate corrections are implemented prior to release.

Datadog Code Security identifies vulnerabilities early in the software development life cycle (development and CI/CD) before teams deploy applications to production. This vulnerability identification is achieved through Datadog’s scanning capabilities, which analyze the source code in repositories to detect vulnerabilities in first-party code and third-party open source libraries. The methodologies are static application security testing (SAST) for first-party code and software composition analysis (SCA) for third-party dependencies. For each identified vulnerability, Datadog provides one or more remediation suggestions, enabling development and DevOps teams to address issues efficiently and effectively.

6.2.3.1: If manual code reviews are performed for bespoke and custom software prior to release to production, code changes are:

• Reviewed by individuals other than the originating code author, and who are knowledgeable about code-review techniques and secure coding practices.
• Reviewed and approved by management prior to release.

For every vulnerability that is detected in source code repositories, Datadog Code Security offers pull request (PR) comments with suggested remediations. These comments can be reviewed by someone other than the original author of the vulnerable code, reducing the risk of security flaws being deployed into production environments.

6.2.4: Software engineering techniques or other methods are defined and in use by software development personnel to prevent or mitigate common software attacks and related vulnerabilities in bespoke and custom software, including but not limited to the following:

• Injection attacks, including SQL, LDAP, XPath, or other command, parameter, object, fault, or injection-type flaws.
• Attacks on data and data structures, including attempts to manipulate buffers, pointers, input data, or shared data.
• Attacks on cryptography usage, including attempts to exploit weak, insecure, or inappropriate cryptographic implementations, algorithms, cipher suites, or modes of operation.
• Attacks on business logic, including attempts to abuse or bypass application features and functionalities through the manipulation of APIs, communication protocols and channels, client-side functionality, or other system/application functions and resources. This includes cross-site scripting (XSS) and cross-site request forgery (CSRF).
• Attacks on access control mechanisms, including attempts to bypass or abuse identification, authentication, or authorization mechanisms, or attempts to exploit weaknesses in the implementation of such mechanisms.
• Attacks via any “high-risk” vulnerabilities identified in the vulnerability identification process, as defined in Requirement 6.3.1.

• SAST rules
• IAST rules
• Attack rules

6.3.1: Security vulnerabilities are identified and managed as follows:

• New security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs).
• Vulnerabilities are assigned a risk ranking based on industry best practices and consideration of potential impact.
• Risk rankings identify, at a minimum, all vulnerabilities considered to be a high-risk or critical to the environment.
• Vulnerabilities for bespoke and custom, and third-party software (for example operating systems and databases) are covered.

6.3.2: An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management.

Datadog Code Security provides an inventory of repositories, services, and third-party components (open source libraries), displaying the vulnerabilities that are associated with each.

6.4.1: For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows:

• Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods as follows:
• At least once every 12 months and after significant changes.
• By an entity that specializes in application security.
• Including, at a minimum, all common software attacks in Requirement 6.2.4.
• All vulnerabilities are ranked in accordance with Requirement 6.3.1.
• All vulnerabilities are corrected.
• The application is re-evaluated after the corrections.

OR

• Installing an automated technical solution(s) that continually detects and prevents web-based attacks as follows:
• Installed in front of public-facing web applications to detect and prevent web-based attacks.
• Actively running and up to date as applicable.
• Generating audit logs.
• Configured to either block web-based attacks or generate an alert that is immediately investigated.

Datadog Code Security and Datadog AAP Threat Management enable continuous security assessment and protection for applications. When applications are integrated with the Datadog Tracing Library, they can self-assess and self-protect in real time:

• Datadog Code Security ensures automated security assessment by continuously analyzing applications for vulnerabilities. Each time a change is made, Datadog Code Security scans the application or API in development and QA environments, providing immediate feedback to developers.
• Datadog AAP Threat Management offers automated technical protection by detecting and preventing known attacks and zero-day attacks. As an in-app web application firewall (WAF) and runtime application self-protection (RASP) solution, Datadog AAP Threat Management helps prevent vulnerability exploitation by offering automatic protection against most zero-day threats.

In addition, Datadog Security Labs offers instant guidance and quick product updates that can be scaled to the entire application portfolio.

6.4.2: For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following:

• Is installed in front of public-facing web applications and is configured to detect and prevent web-based attacks.
• Actively running and up to date as applicable.
• Generating audit logs.
• Configured to either block web-based attacks or generate an alert that is immediately investigated.

Datadog AAP Threat Management continuously detects and mitigates known attacks, helping to meet compliance obligations with automated technical protection. When applications are integrated with the Datadog Tracing Library, they remain self-protecting at all times. For each detected attack, an audit log is generated. Datadog AAP Threat Management can operate in:

• Monitoring Mode: Generates alerts for detected attacks without blocking them.
• Blocking Mode: Blocks detected attacks while also generating alerts and audit logs.