Secure Coding Concepts

Question 1

Compiled Code vs Runtime code

Answer 1

Compliled code is optimized by a compiler and converted into an executable file, checking for errors and reporting back to the developer.
Runtime code is evaluated, interpreted, and executed when the code is run.

Question 2

Input validation

Answer 2

The practice of checking data for validity before using it. Prevents an attacker from sending malicious code by sanitizing the input or rejecting it.

Question 3

What are some common checks performed by input validation?

Answer 3

Verifying proper characters in certain fields
Implementing boundary/range checking
Blocking HTML code such as < and >
Preventing the use of specific characters (i.e. = ‘ -)

Question 4

Race Condition

Answer 4

Occurs when 2 or more modules of an application or 2 applications attempt to access a resource at the same time.

Question 5

What are 2 general guidelines to proper error-handling?

Answer 5

• Make sure errors to users are general, to prevent an attacker from exploiting the system/application
• Detailed error information should be logged, so that developers can identify the cause of the error.

Question 6

Code Signing

Answer 6

The practice of using a certificate and associating it with an application or code. Provides the code with a digital signature and the certificate includes a hash of the code.

• Certificate identifies the author.
• The hash verifies that the code has not been modified.

Question 7

Code Obfuscation

Answer 7

The practice of making code more difficult to read or understand, such as renaming variables, replacing strings of characters with hexadecimal characters, etc.

Question 8

Static code analysis vs Dynamic analysis

Answer 8

Static analysis examines the code without actually executing it.
Dynamic analysis checks the code while it’s running via fuzzing (sends random data to an application to see how it is handled)

Question 9

Stress Testing

Answer 9

Simulates a live environment to determine how effective an application will operate with a load.

Question 10

Sandboxing

Answer 10

The practice of testing an application in an isolated environment, so that any changes made will not affect anything outside of it.

Question 11

The Waterfall SDLC model

Answer 11

Uses multiple stages going from top to bottom, with each stage feeding the next. When followed strictly, when one stage is completed, you do not return to it. Can lack flexibility as it’s difficult to revise things from previous stages.

Question 12

The Agile SDLC model

Answer 12

Uses a set of principles shared by cross-functional teams, stressing interaction, creating a working application, collaborating with the customer, and responding to change. Uses iterative cycles rather than stages, with each cycle creating a working product. The next cycle adds changes from the previous one.

Question 13

Secure DevOps

Answer 13

An agile-aligned methodology that stresses security throughout the life cycle of the project. Can allow developers to push out multiple updates daily in response to changing business needs.

Question 14

Continuous Integration

Answer 14

The process of merging changes in code into a central repository, in which the software is then built+tested from this repository.

Question 15

Baselining (in context of DevOps)

Answer 15

Application of changes to the baseline code every day and then building the code from those changes.

Question 16

Infrastructure as Code

Answer 16

refers to managing and provisioning data centers with code that defines VMs.