Gain insight into our software development process and how we prioritise security at every phase, from initial design, through to operating our software day to day. Security is at the heart of how we design, develop and run our products.
Sage Secure Software Development Lifecycle (SDLC) standard is followed by the product engineering teams, including secure coding standards and guidelines.
Pre-release
The Sage product security control standard defines the security controls that we expect our products to adopt. Based on leading industry frameworks such as OWASP ASVS and NIST, our standard has been tailored to be a comprehensive framework to help reduce cyber-security risks that impact our products and customers. It includes security controls throughout the development lifecycle and in the operation of our products.
Pre-release
Our global security team provide expert advice and support to product engineering teams in Sage, and also draw upon our industry-leading security champions programme. Security champions are established best practice in the software industry, where identified software developers and engineers work as an extension of the security team. They do this by contributing to threat modelling, triaging and resolving vulnerabilities and helping to respond to incidents. All Sage security champions undertake specialised security training, participate in competitions and events and provide an invaluable contribution to our security mission.
Pre-release
Part of our commitment to secure by design, threat modelling is used to understand how our products and systems could be abused or attacked and allows us to design security into our products from the outset. We use various techniques for modelling our systems, including STRIDE, and we train and involve a wide number of people in threat modelling, including application security and cloud security experts, developers, and software architects.
Pre-release
Equipping our team with the necessary skills and fostering a culture of shared security responsibility is crucial for staying ahead of threats and ensuring the development of secure products. We heavily invest in training our software developers, engineers, and security teams, collaborating with industry leaders such as Pluralsight, LinkedIn Learning, and Immersive Labs to provide comprehensive theoretical and hands-on, lab-based training.
Pre-release
We support our developers in writing high-quality and secure code by developing secure coding standards that outline what we expect so that common security weaknesses are avoided. We follow OWASP and Cloud Security Alliance guidance amongst others and adapt it to fit Sage’s context and products.
Pre-release
We deploy code scanning and security testing tools throughout our SDLC to catch vulnerabilities and coding errors as early as possible so they can be addressed before entering production. Our partnership with Microsoft is pivotal to our security posture, and many of our products use GitHub advanced security. Static and dynamic application security testing, secret scanning and dependency scanning are among the tools integrated into our software development and delivery pipelines, ensuring we have the visibility to address security risks as early as possible.
Pre-release
Sage has invested in building our own internal offensive security team who are responsible for conducting attack simulations (both penetration tests and red teaming exercises) against our products to help identify weaknesses that can be exploited by bad actors, allowing us to resolve them in a controlled and timely way. We also partner with external penetration testing firms to give us an independent view and provide us with healthy challenge.
Pre-release
For new products and changes to existing products that could have an impact on security, we undertake structured release reviews to ensure our security expectations have been met. We will always put trust and security first, and we will not release any software that does not meet our high security standards.
Release
Post-release
Our focus on security does not stop once a product has been developed and delivered. We actively monitor our products to spot suspicious behaviour, and quickly investigate and respond to events. Our dedicated cyber defensive operations team monitor our systems 24 hours a day, every day, and our global incident response team can quickly coordinate responses across all parts of the business.
Post-release
Sage runs a private bug bounty program through HackerOne. Approved security researchers and ethical hackers test Sage products for vulnerabilities, simulating real-world attacks. We reward them for valid findings and collaborate transparently to swiftly resolve issues.
Post-release
The insights from our security tools, incident experiences, penetration testing, and red teaming inform product protection enhancements. We regularly review this data to improve training, standards, and cybersecurity awareness events like Cyber Security Week and our annual Security Champions event.
Learn more about our unwavering commitment to cyber security. Dive deeper with our dedicated pages on monitoring operations and standards compliance.
Explore the depth of our 24/7 monitoring and operations strategy, dedicated to ensuring the utmost security and reliability of your data and systems.
Delve into our commitment to standards and compliance, and discover how Sage ensures operations that exceed global best practices.
Give Feedback
