Trust in Security
From preventing unauthorized access to developing secure software, SAS takes every measure to protect your information.
SAS Product Security Framework
At SAS, we engineer our software to protect your data and your business. Our SAS® Product Security Framework incorporates industry best practices and defines the guiding principles for our secure product development life cycle. From engineering through vulnerability remediation, we ensure that our products continually meet the business and security needs of our customers.
Architecture & design
Secure software begins with product design. SAS developers work with a specialized security architecture team to plan new features built on strong security architecture options. Design reviews and checkpoints help SAS engineers ensure that they are incorporating secure design concepts into SAS products. And the architectural design helps developers maintain critica security properties, as well as proactively address known security weaknesses.
Product security response & mediation
Our commitment to security doesn't end when a product is released. Our Product Security Incident Response Team (PSIRT) investigates possible post-release security vulnerabilities, prioritizes any identified incidents based on potential severity, and mobilizes resources to address them. To get the latest security updates and status reports, download SAS Security Bulletins.
Security issue identification & resolution
A foundation of education rests at the heart of the SAS Product Security Framework to ensure that everyone responsible for creating, testing and implementing SAS technology shares a common perspective on security. And education about security is available in many forms - from training classes and mentoring programs, to guidelines for development standards, to collaboration between development teams and IT and beyond.
Development standards, testing & validation
We adhere to strict development standards and perform a variety or testing and validation processes that include both internally developed and third-party scanning and vulnerability tools.
