D487 - Secure Software Design
SDLC Phase 1 - Answer- planning - a vision and next steps are created
SDLC Phase 2 - Answer- requirements - necessary software requirements are
determined
SDLC Phase 3 - Answer- design - requirements are prepared for the technical
design
SDLC Phase 4 - Answer- implementation - the resources involved in the application
from a known resource are determined
SDLC Phase 5 - Answer- testing - software is tested to verify its functions through a
known environment
SDLC Phase 6 - Answer- deployment - security is pushed out
SDLC Phase 7 - Answer- maintenance - ongoing security monitoring is implemented
SDLC Phase 8 - Answer- end of life - the proper steps for removing software
completely are considered
BSIMM - Answer- a study of real-world software security that allows you to develop
your software security over time
OWASP SAMM - Answer- flexible framework for building security into a software
development organization
Static Analysis - Answer- the analysis of computer software that is performed without
executing programs
Dynamic Analysis - Answer- the analysis of computer software that is performed
when executing programs on a real or virtual processor in real time
Fuzz Testing - Answer- automated or semi-automated testing that provides invalid,
unexpected, or random data to the computer software program
Waterfall Development - Answer- software development methodology that breaks
down development activities into linear sequential phases; each phase depends on
the deliverables of the previous one and corresponds to a specialization of tasks
Waterfall Phases (typical) - Answer- plan -> build -> test -> review -> deploy
Iterative Waterfall Development - Answer- each phase of a project is broken down
into its own waterfall phases
, Agile Development - Answer- software development methodology that delivers
functionality in rapid iterations called timeboxes, requiring limited planning but
frequent communication
Scrum - Answer- framework for Agile that prescribes for teams to break work into
goals to be completed within sprints
Scrum Master (Scrum Role) - Answer- responsible for ensuring a Scrum team is
operating as effectively as possible by keeping the team on track, planning and
leading meetings, and working out any obstacles the team might face
Product Owner (Scrum Role) - Answer- ensures the Scrum team aligns with overall
product goals by managing the product backlog by ordering work by priority, setting
the product vision for the team, and communicating with external stakeholders to
translate their needs to the team
Development Team (Scrum Role) - Answer- professionals who do the hands-on
work of completing the tasks in a Scrum sprint by lending their expertise to program,
design, or improve products
Lean Development - Answer- software development methodology that focuses on
further isolating risk to the level of an individual feature
V-Model - Answer- a variation of the waterfall model, where the stage is turned back
upwards after the coding phase
Extreme Programming (XP) - Answer- an Agile methodology that is intended to
improve software quality and responsiveness
Software Security Architect - Answer- ensures that the stakeholder security
requirements necessary to protect the organization's mission and business
processes are adequately addressed
Software Security Champion - Answer- an expert on promoting security awareness,
best practices, and simplifying software security
Software Security Evangelist - Answer- an expert to promote awareness of products
to the wider software community
Functional Requirements - Answer- describe what the system will do and its core
purpose
Non-Functional Requirements - Answer- describe any constraints or restrictions on a
design but do not impact the core purpose of the system
Privacy Impact Assessment - Answer- process that evaluates issues and privacy
impact rating in relation to the privacy of PII in the software
Product Risk Profile - Answer- helps to determine the actual cost of the product from
different perspectives
SDLC Phase 1 - Answer- planning - a vision and next steps are created
SDLC Phase 2 - Answer- requirements - necessary software requirements are
determined
SDLC Phase 3 - Answer- design - requirements are prepared for the technical
design
SDLC Phase 4 - Answer- implementation - the resources involved in the application
from a known resource are determined
SDLC Phase 5 - Answer- testing - software is tested to verify its functions through a
known environment
SDLC Phase 6 - Answer- deployment - security is pushed out
SDLC Phase 7 - Answer- maintenance - ongoing security monitoring is implemented
SDLC Phase 8 - Answer- end of life - the proper steps for removing software
completely are considered
BSIMM - Answer- a study of real-world software security that allows you to develop
your software security over time
OWASP SAMM - Answer- flexible framework for building security into a software
development organization
Static Analysis - Answer- the analysis of computer software that is performed without
executing programs
Dynamic Analysis - Answer- the analysis of computer software that is performed
when executing programs on a real or virtual processor in real time
Fuzz Testing - Answer- automated or semi-automated testing that provides invalid,
unexpected, or random data to the computer software program
Waterfall Development - Answer- software development methodology that breaks
down development activities into linear sequential phases; each phase depends on
the deliverables of the previous one and corresponds to a specialization of tasks
Waterfall Phases (typical) - Answer- plan -> build -> test -> review -> deploy
Iterative Waterfall Development - Answer- each phase of a project is broken down
into its own waterfall phases
, Agile Development - Answer- software development methodology that delivers
functionality in rapid iterations called timeboxes, requiring limited planning but
frequent communication
Scrum - Answer- framework for Agile that prescribes for teams to break work into
goals to be completed within sprints
Scrum Master (Scrum Role) - Answer- responsible for ensuring a Scrum team is
operating as effectively as possible by keeping the team on track, planning and
leading meetings, and working out any obstacles the team might face
Product Owner (Scrum Role) - Answer- ensures the Scrum team aligns with overall
product goals by managing the product backlog by ordering work by priority, setting
the product vision for the team, and communicating with external stakeholders to
translate their needs to the team
Development Team (Scrum Role) - Answer- professionals who do the hands-on
work of completing the tasks in a Scrum sprint by lending their expertise to program,
design, or improve products
Lean Development - Answer- software development methodology that focuses on
further isolating risk to the level of an individual feature
V-Model - Answer- a variation of the waterfall model, where the stage is turned back
upwards after the coding phase
Extreme Programming (XP) - Answer- an Agile methodology that is intended to
improve software quality and responsiveness
Software Security Architect - Answer- ensures that the stakeholder security
requirements necessary to protect the organization's mission and business
processes are adequately addressed
Software Security Champion - Answer- an expert on promoting security awareness,
best practices, and simplifying software security
Software Security Evangelist - Answer- an expert to promote awareness of products
to the wider software community
Functional Requirements - Answer- describe what the system will do and its core
purpose
Non-Functional Requirements - Answer- describe any constraints or restrictions on a
design but do not impact the core purpose of the system
Privacy Impact Assessment - Answer- process that evaluates issues and privacy
impact rating in relation to the privacy of PII in the software
Product Risk Profile - Answer- helps to determine the actual cost of the product from
different perspectives
