Software Development Security

Question 1

Capability Maturity Model Integration (CMMI) Levels

Answer 1

Level 1 (Initial) - ad-hoc/chaotic - beginning level
Level 2 (Managed) - "basic" PM process established to track cost, schedule and functionality
Level 3 (Defined) - management and engineering activities is "documented, standardized and integrated" into standard software process
Level 4 (Quantitatively Managed) - detailed measures in the software process and product are measured
Level 5 Optimizing - continuous process improvement is enabled by quantitative feedback

Question 2

Capability Maturity Model Integration (CMMI)

Answer 2

focus on quality management

basis for evaluation development process

Question 3

Software Development Lifecycle (SDLC)

Answer 3

Methodologies for software development to improve the process and end product

Question 4

Software Development Methodology Types

Answer 4

Waterfall
Spiral
Prototyping
Rapid Application Development (RAD)
Agile
Extreme Programming (XP)
Scrum

Question 5

Waterfall

Answer 5

Phases occur in succession, once complete not revisited

No customer involvement

Question 6

Spiral

Answer 6

Managing “risk”
phases occur in order
Phases are repeated over and over

Question 7

Prototyping

Answer 7

Mock something up, get feedback from client

Question 8

Agile

Answer 8

Pair programming, continuous integration and continuous deployment
Don’t wait to fix problems

Question 9

Extreme Programming (XP)

Answer 9

Pair programming
one programs while the other assists and verifies if it's within spec
may swap places
High level customer involvement
detailed test procedures

Question 10

SCRUM

Answer 10

relay race - hand off work to other team members
small developments team
Scrum master is senior member of the organization who act as a coach for the team
Product Owner represents business unit

Question 11

Computer Aided Software Engineering (CASE) tools

Answer 11

Generates code for you

Question 12

DevOps

Answer 12

Development directly supports Operations

Question 13

Security Development Cycle

Answer 13

Discover bugs sooner, shift left

Question 14

SD3+C

Answer 14

Secure by Design
Secure by Default
Secure by Deployment
Secure by Communications

Question 15

Secure by Default

Answer 15

Least privilege
Defense in Depth
Conservative default settings
avoid risky changes
less commonly used services off by default

Question 16

Secure by Deployment

Answer 16

Deployment guidelines
Analysis and management tools
Patch development tools

Question 17

Remote Procedure Protocol (RPC)

Answer 17

client to send input to a process running on remote system

Question 18

Privilege Escalation

Answer 18

Privilege Escalation attack increases a user/process to superuser