D487 SECURE SOFTWARE DESIGN
COMPREHENSIVE TEST PAPER WITH
SOLVED QUESTIONS
◉ Authorization
Answer: - Verifies the identity of a user, system, or device before
allowing interaction
- Ensures that the user has the appropriate role & privilege to
view data
◉ Authentication
Answer: - Grants specific privileges and access rights to
authenticated entities based on the "principle of least privilege"
- Ensures that the user is who he or she claims to be & that the
data come from the appropriate place
◉ Integrity
Answer: - Guarantees that data and system code remain accurate,
trustworthy, and free from unauthorized tampering
,- Guarding against improper information modification or
destruction, & includes ensuring information non-repudiation &
authenticity
- Achieved using version control (like GitLab or GitHub), digital
signatures, hashing, public keys, and Static Application Security
Testing (SAST)
◉ Availability
Answer: - Ensures systems and data are reliable and accessible to
authorized users when needed
- Maintained through infrastructure redundancy, load balancing,
proper disaster recovery planning, and Dynamic Application
Security Testing (DAST)
◉ Information Security
Answer: - Protection of information & information systems from
unauthorized access, use, disclosure, disruption, modification, or
destruction in order to provide confidentiality, integrity, and
availability
◉ Attack Surface
Answer: - Represents all the exposed code, interfaces, entry
points, & exit points where an unauthorized user can interact with
or extract data
,- Elements of the attack surface can be identified with
the use of scanning tools, such as port scanning tools for open
ports, and code analysis tools to
locate the portions of the code that receive input and send output
- Minimum attack surface is defined early in SDLC & measured
again through later phases
◉ BSIMM (Building Security In Maturity Model)
Answer: - Descriptive or Observational (Shows what other orgs
are doing so you can see where you stand)
- Studies real-world software security initiatives for
benchmarking (How am I doing compared to others?)
- Framework documenting real-world practices observed across
hundreds of orgs effectively mapping how security integrates with
your Secure Software Development Life Cycle
- 4 Domains broken down into 12 categories:
- Domain 1: Governance: practices that help organize, manage,
and measure a software security initiative (running & managing a
S/W security program)
- Categories: Strategy & Metrics, Compliance & Policy, Training
, - Domain 2: Intelligence: practices that result in collections of
corporate knowledge used in carrying out software security
activities throughout the org (how the org gathers, builds, &
shares security knowledge)
- Categories: Attack Models, Security Features & Designs,
Standards & Requirements
- Domain 3: SDL Touchpoints: practices associated with the
analysis & assurance of particular software development artifacts
& processes (applying security knowledge, resources, &
principles)
- Categories: Architecture Analysis, Code Review, Security Testing
- Domain 4: Deployment: practices that interface with traditional
network security & software maintenance organizaitons
(handling security after S/W is built & released)
- Categories: Pen Testing, S/W Environment, Configuration &
Vulnerability Management
◉ OWASP OPen SAMM (Software Assurance Maturity Model)
Answer: - Prescriptive (Tells you what you should do to improve)
- Helps organizations create S/W security strategies for org-
specific risks
- 4 Core Activities broken down into 12 categories
COMPREHENSIVE TEST PAPER WITH
SOLVED QUESTIONS
◉ Authorization
Answer: - Verifies the identity of a user, system, or device before
allowing interaction
- Ensures that the user has the appropriate role & privilege to
view data
◉ Authentication
Answer: - Grants specific privileges and access rights to
authenticated entities based on the "principle of least privilege"
- Ensures that the user is who he or she claims to be & that the
data come from the appropriate place
◉ Integrity
Answer: - Guarantees that data and system code remain accurate,
trustworthy, and free from unauthorized tampering
,- Guarding against improper information modification or
destruction, & includes ensuring information non-repudiation &
authenticity
- Achieved using version control (like GitLab or GitHub), digital
signatures, hashing, public keys, and Static Application Security
Testing (SAST)
◉ Availability
Answer: - Ensures systems and data are reliable and accessible to
authorized users when needed
- Maintained through infrastructure redundancy, load balancing,
proper disaster recovery planning, and Dynamic Application
Security Testing (DAST)
◉ Information Security
Answer: - Protection of information & information systems from
unauthorized access, use, disclosure, disruption, modification, or
destruction in order to provide confidentiality, integrity, and
availability
◉ Attack Surface
Answer: - Represents all the exposed code, interfaces, entry
points, & exit points where an unauthorized user can interact with
or extract data
,- Elements of the attack surface can be identified with
the use of scanning tools, such as port scanning tools for open
ports, and code analysis tools to
locate the portions of the code that receive input and send output
- Minimum attack surface is defined early in SDLC & measured
again through later phases
◉ BSIMM (Building Security In Maturity Model)
Answer: - Descriptive or Observational (Shows what other orgs
are doing so you can see where you stand)
- Studies real-world software security initiatives for
benchmarking (How am I doing compared to others?)
- Framework documenting real-world practices observed across
hundreds of orgs effectively mapping how security integrates with
your Secure Software Development Life Cycle
- 4 Domains broken down into 12 categories:
- Domain 1: Governance: practices that help organize, manage,
and measure a software security initiative (running & managing a
S/W security program)
- Categories: Strategy & Metrics, Compliance & Policy, Training
, - Domain 2: Intelligence: practices that result in collections of
corporate knowledge used in carrying out software security
activities throughout the org (how the org gathers, builds, &
shares security knowledge)
- Categories: Attack Models, Security Features & Designs,
Standards & Requirements
- Domain 3: SDL Touchpoints: practices associated with the
analysis & assurance of particular software development artifacts
& processes (applying security knowledge, resources, &
principles)
- Categories: Architecture Analysis, Code Review, Security Testing
- Domain 4: Deployment: practices that interface with traditional
network security & software maintenance organizaitons
(handling security after S/W is built & released)
- Categories: Pen Testing, S/W Environment, Configuration &
Vulnerability Management
◉ OWASP OPen SAMM (Software Assurance Maturity Model)
Answer: - Prescriptive (Tells you what you should do to improve)
- Helps organizations create S/W security strategies for org-
specific risks
- 4 Core Activities broken down into 12 categories
