Domain 8 Software Development Security

Inhoud verberg
1 🔑 1. Key Concepts
2 📖 2. Deep Dive (Expanded)
2.1 🔹 Secure SDLC (Software Development Lifecycle)
2.1.1 Phases:
2.2 🔹 Development Methodologies
2.2.1 Waterfall
2.2.2 Agile
2.2.3 DevOps
2.3 🔹 Secure Coding Practices
2.4 🔹 Code Review & Testing
2.4.1 Code Review
2.4.2 Testing Types:
2.5 🔹 Common Vulnerabilities
2.6 🔹 Environment Management
2.7 🔹 Change & Configuration Management
2.8 🔹 Application Security Controls
3 🧠 3. Manager Mindset
4 ❓ 4. Practice Questions
4.1 1
4.2 2
4.3 3
4.4 4
4.5 5
4.6 6
4.7 7
4.8 8
4.9 9
4.10 10
4.11 11
4.12 12
4.13 13
4.14 14
4.15 15
4.16 16
4.17 17
4.18 18
4.19 19
4.20 20
5 ✅ 5. Answers + Reasoning
5.1 1
5.2 2
5.3 3
5.4 4
5.5 5
5.6 6
5.7 7
5.8 8
5.9 9
5.10 10
5.11 11
5.12 12
5.13 13
5.14 14
5.15 15
5.16 16
5.17 17
5.18 18
5.19 19
5.20 20
6 ⚠️ 6. Exam Traps
7 🔄 7. Flash Review
8 📊 8. Score

🔑 1. Key Concepts

  • Secure Software Development Lifecycle (SDLC)
  • Development Methodologies (Waterfall, Agile, DevOps)
  • Secure Coding Practices
  • Code Review & Testing
  • Software Vulnerabilities (OWASP Top 10)
  • Environment Management (Dev/Test/Prod)
  • Change & Configuration Management
  • Application Security Controls

📖 2. Deep Dive (Expanded)

🔹 Secure SDLC (Software Development Lifecycle)

Security must be integrated into every phase of development.

Phases:

  1. Requirements
    • Define security requirements
  2. Design
    • Threat modeling
    • Secure architecture
  3. Development
    • Secure coding practices
  4. Testing
    • Security testing (SAST, DAST)
  5. Deployment
    • Secure configuration
  6. Maintenance
    • Patch and update

Why it matters:
Fixing issues early is cheaper and more effective.

Exam insight:
Security is built-in, not added later.

🔹 Development Methodologies

Waterfall

  • Sequential phases
  • Rigid, structured

Agile

  • Iterative development
  • Frequent updates

DevOps

  • Combines development and operations
  • Continuous integration/deployment (CI/CD)

Why it matters:
Security must adapt to the development approach.

🔹 Secure Coding Practices

Key principles:

  • Input validation
  • Output encoding
  • Error handling
  • Least privilege
  • Avoid hardcoded credentials

Why it matters:
Most vulnerabilities come from insecure code.

🔹 Code Review & Testing

Code Review

  • Manual or automated
  • Detects logic flaws

Testing Types:

  • SAST (Static Application Security Testing)
    • Analyzes code without executing
  • DAST (Dynamic Application Security Testing)
    • Tests running application

Why it matters:
Early detection reduces risk.

🔹 Common Vulnerabilities

Based on OWASP Top 10:

  • Injection (SQL, command)
  • Broken authentication
  • Sensitive data exposure
  • Security misconfiguration
  • Cross-Site Scripting (XSS)

Why it matters:
These are the most common real-world threats.

🔹 Environment Management

Separate environments:

  • Development
  • Testing
  • Production

Rules:

  • No real data in test
  • Strict access control

Why it matters:
Prevents accidental exposure.

🔹 Change & Configuration Management

Controls software changes:

  • Version control
  • Approval process
  • Rollback capability

Why it matters:
Prevents unauthorized or risky changes.

🔹 Application Security Controls

Examples:

  • Authentication mechanisms
  • Authorization controls
  • Encryption
  • Logging

Why it matters:
Protects application from attacks.

🧠 3. Manager Mindset

  • Build security into development
  • Test continuously
  • Reduce vulnerabilities early
  • Enforce secure coding standards

👉 Think: Are we building secure software from the start?

❓ 4. Practice Questions

1

What is the first phase of SDLC?
A. Design
B. Development
C. Requirements
D. Testing

2

What is the purpose of secure SDLC?
A. Speed
B. Cost reduction
C. Integrate security
D. Monitoring

3

What is Agile?
A. Sequential model
B. Iterative development
C. Waterfall model
D. Monitoring

4

What is DevOps?
A. Backup
B. Combined development and operations
C. Monitoring
D. Encryption

5

What is input validation?
A. Encrypt input
B. Verify input
C. Store input
D. Monitor input

6

What is SAST?
A. Runtime testing
B. Static code analysis
C. Monitoring
D. Encryption

7

What is DAST?
A. Static testing
B. Runtime testing
C. Monitoring
D. Encryption

8

What is code review?
A. Backup
B. Analyze code
C. Monitor logs
D. Encrypt data

9

What is SQL injection?
A. Backup
B. Code vulnerability
C. Encryption
D. Monitoring

10

What is XSS?
A. Backup
B. Code injection
C. Encryption
D. Monitoring

11

What is the purpose of environment separation?
A. Speed
B. Security
C. Cost
D. Monitoring

12

What should NOT be used in test environments?
A. Logs
B. Real data
C. Encryption
D. Monitoring

13

What is version control?
A. Backup
B. Track changes
C. Monitoring
D. Encryption

14

What is the purpose of change management?
A. Speed
B. Control changes
C. Monitoring
D. Backup

15

What is the biggest source of vulnerabilities?
A. Hardware
B. Software
C. Network
D. Monitoring

16

What is least privilege in coding?
A. Full access
B. Minimal access
C. No access
D. Shared access

17

What is secure configuration?
A. Backup
B. Safe setup
C. Monitoring
D. Encryption

18

What is the BEST time to fix vulnerabilities?
A. After deployment
B. During development
C. After testing
D. After incident

19

What is the purpose of OWASP?
A. Encryption
B. Security awareness
C. Backup
D. Monitoring

20

What is the main goal of software security?
A. Speed
B. Cost
C. Secure applications
D. Storage

✅ 5. Answers + Reasoning

1

C. Requirements
Security must start at the requirements phase to ensure proper design.

2

C. Integrate security
Secure SDLC ensures security is part of every phase.

3

B. Iterative development
Agile focuses on continuous improvement and updates.

4

B. Combined development and operations
DevOps integrates development and operations for faster delivery.

5

B. Verify input
Input validation ensures data is safe before processing.

6

B. Static code analysis
SAST analyzes code without executing it.

7

B. Runtime testing
DAST tests applications while running.

8

B. Analyze code
Code review identifies flaws and vulnerabilities.

9

B. Code vulnerability
SQL injection allows attackers to manipulate databases.

10

B. Code injection
XSS injects malicious scripts into web applications.

11

B. Security
Separating environments prevents accidental exposure.

12

B. Real data
Using real data in test environments increases risk.

13

B. Track changes
Version control tracks modifications to code.

14

B. Control changes
Change management ensures safe implementation.

15

B. Software
Most vulnerabilities originate in application code.

16

B. Minimal access
Least privilege limits access rights.

17

B. Safe setup
Secure configuration reduces vulnerabilities.

18

B. During development
Fixing early is cheaper and more effective.

19

B. Security awareness
OWASP provides guidance on common vulnerabilities.

20

C. Secure applications
The goal is to build and maintain secure software.

⚠️ 6. Exam Traps

  • Thinking security is only testing
  • Ignoring early SDLC phases
  • Confusing SAST vs DAST
  • Using real data in testing

🔄 7. Flash Review

  • Secure SDLC
  • Agile / DevOps
  • Input validation
  • SAST vs DAST
  • OWASP Top 10
  • Separate environments

📊 8. Score

Score: ___ / 20

  • 16–20 → ✅ Strong
  • 10–15 → ⚠️ Review
  • <10 → ❌ Re-study Domain 8
©J CyberStop