SSDLC and Security Assessment Flashcards
Why is modern software hard to develop and maintain correctly?
Because they are large, complex with many dependencies. Maintenance cycles are also usually long and
conducted for a set period of time after release.
What is the Software Maintenance Challenge?
The fact that ever more complex software requires more and more maintenance.
What are the 7 steps of SAP’s Secure Software Development Lifecycle?
Training, Risk Identification, Planning security response, Secure development, Security testing,
Security validation, Security Response.
Give an example of the secure development cycle for Cloud / Agile?
Define: Risk identification, Security measures.
Build process: Secure development, Security testing, Security Validation.
Release software: Security response.
What is more likely if SAP’s SSDLC is not followed?
Insecure software is more likely to be produced.
What is the purpose of CWE and CVE? What is the difference?
The overarching purpose is a unified way of categorising and logging system vulnerabilities. The difference between them is CWE (Common Weakness Enumeration) is a listing of all vulnerability types known. CVE (Common
Vulnerability Enumeration) is a list of all logged vulnerability occurrences.
What is the scoring system used to determine the severity of vulnerabilities?
Commonn Vulnerability Scoring System. < 3 (low priority); 4,5 (Add to backlog); 6,7 (fix in next maintenance cycle);
8,9,10 (fix immediately).
What is OWASP Top 10?
A list of the most common vulnerabilities across all applications.
1 : Broken Access Control
2 : Cryptographic failures
3 : Injection
4 : Insecure design
5 : Security misconfiguration
6 : Old components / dependencies
7 : Authentication and Identification failures
8 : Software and Data integrity failures
9 : Security logging and monitor failures
10 : Request forgery (SSRF, CSRF(XSS))
What is an issue with no. 9 of the OWASP Top 10?
Logging and monitoring failures : For business over logging is good as it provides more recovery points. However,
from a privacy point of view it’s bad since constant personal data is being collected and logged.
