Application Security in the Software Lifecycle - Study Guide
Application Security in the Software Lifecycle - Study Guide
Nota importada desde Inbox durante consolidacion bulk.
Key Concepts
- Security Vulnerabilities: Different techniques are employed at various stages of an application's lifecycle (design, development, deployment, upgrade, and maintenance) to identify security vulnerabilities.
Network vs. Application Security
- Network Security: Involves protecting systems and information assets at the network level (routers, switches, servers, etc.) using technologies like firewalls and intrusion prevention systems.
- Application Security: Focuses on safeguarding application front ends, source code, and software-level information assets (websites, databases, apps). Utilizes tools like web application firewalls and source code analyzers.
Threat, Risk, and Vulnerability
- Threat: A potential security violation (e.g., malware, hackers).
- Risk: Likelihood of an attack (e.g., earthquake risk at different locations).
- Vulnerability: A security flaw in code, including known and zero-day vulnerabilities.
Software Development Methodologies
- Waterfall: Top-down, simple but inflexible, costly for late design flaw discovery.
- Agile: Short bursts of development cycles, responsive, but may overlook security in haste.
- Scrum: Agile-focused, 1-4 week sprints, but similar pros and cons as Agile.
- Spiral: Risk-focused, evaluates security each cycle, slower and potentially costlier than Agile.
- Iterative: Breaks development into smaller prototypes, but may miss security in short cycles.
Penetration Testing Categories
- White-Box Testing: Attackers have detailed system information.
- Black-Box Testing: Attackers have no prior information, simulating an external attack.
- Gray-Box Testing: Partial knowledge, a balance between white and black-box testing.
Technologies for Identifying Vulnerabilities
- Static Application Security Testing (SAST): Analyzes source code for vulnerabilities pre-launch, requires expert configuration.
- Dynamic Application Security Testing (DAST): Scans visible vulnerabilities post-launch, scalable but prone to false positives/negatives.
- Interactive Application Security Testing (IAST): Assesses applications from within, combines SAST and DAST strengths.
Study Notes
- Understand the difference between network and application security.
- Familiarize with the definitions of threat, risk, and vulnerability.
- Review the characteristics and pros/cons of different software development methodologies.
- Learn the distinctions between white-box, black-box, and gray-box penetration testing.
- Explore the functionalities and limitations of SAST, DAST, and IAST in application security.
Use these notes to study the various aspects of application security within the software development lifecycle. It's important to grasp how different security measures and methodologies are applied at each stage of development and maintenance.