Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    Only $9.99/month after trial. Cancel anytime.

    Software Development Security: CISSP, #8
    Software Development Security: CISSP, #8
    Software Development Security: CISSP, #8
    Ebook119 pages2 hours

    Software Development Security: CISSP, #8

    By Selwyn Classen

    ()

    Read preview

    About this ebook

    Security Operations is the 8th domain of the CISSP's common body of knowledge. This course will cover the following' application security, systems development life cycle (SDLC), secuirty impact of acquired software, software threats, programming language concepts and concerns, secure coding and security control concepts.

    LanguageEnglish
    PublisherSelwyn Classen
    Release dateApr 2, 2020
    ISBN9781393681038
    Software Development Security: CISSP, #8
    Author

    Selwyn Classen

    A seasoned and highly qualified IT/IS professional with over 20 years working experience within the Petrochemical industry (i.e. Supply chain management, Knowledge management, Product and Quality management, Business analysis and processing) including the Telecommunications industry.

    Read more from Selwyn Classen

    Related to Software Development Security

    Titles in the series (8)

    View More
    View More

    Related ebooks

    Software Development & Engineering For You

    View More
    View More

    Related podcast episodes

    Related articles

    Related categories

    Reviews for Software Development Security

    0 ratings

    0 ratings0 reviews

    What did you think?

    Tap to rate

    Review must be at least 10 words

      Book preview

      Software Development Security - Selwyn Classen

      While every precaution has been taken in the preparation of this book, the publisher assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.

      SOFTWARE DEVELOPMENT SECURITY

      First edition. April 2, 2020.

      Copyright © 2020 Selwyn Classen.

      Written by Selwyn Classen.

      Table of Contents

      Introduction

      Overview

      Application Security

      Overview

      The Importance of Application Security

      Governance

      Controls, Versioning, and Change Control

      Process Improvement

      Personnel and Conclusion

      Development Life Cycle

      Introduction

      Terminology and Introduction to SDLC

      Injecting Security into the SDLC

      Why Use Software Development Models?

      Common Software Development Models

      Agile Methodologies

      Conclusion

      Security Impact of Acquired Software

      Introduction

      Impact of Acquired Software

      Governance

      References and Conclusion

      Software Threats

      Introduction

      Misconfigurations, Buffer Overflows, Injection

      Path Traversal, Covert Channels, DOS, Trap Doors, Flaws

      Social Engineering, Errors, XSS, Brute Force, CSRF

      File Inclusion, Violations, Undocumented Functionality

      Metadata and Conclusion

      Programming Language Concepts and Concerns

      Introduction

      Programming Language Concepts

      Introduction to Object Oriented Programming

      Distributed Programming and Course Conclusion

      Secure Coding and Security Control Concepts

      Introduction

      The Cause of Software Vulnerabilities

      Defense in Depth and Input Validation

      Outputs, Cryptography, and Fail Secure

      Memory Protection, Architecture, and Code Review

      Code Reuse, Security Testing, and Patching

      Deployment and Well Defined Systems

      Separation of Duties and Anti-malware

      Audit Trails and Course Conclusion

      Introduction

      In this course, we will be discussing the software development security concepts that you should be familiar with before attempting the CISSP examination. We begin the course with an overview of what Application Security even means, and why it is important. This includes reviewing governance concerns and even versioning and change control. We also look at the process of software development and how to inject security in the right places. And then quickly review the security impact that employees have on. 

      Overview

      Once the application security foundation has been set, we can move towards talking about key terminology that everyone should be familiar with, the various concepts directly related to the development life cycle, and then take a look at some more common development models, such as waterfall, and spiral. A bad software purchase and integration can turn a secured environment into something that is just begging to be hacked by the bad guys. In the Software Acquisition module, we will take a look at ensuring that any third-party software we buy does not harm our existing environments. We will review the types of documentation that you should be asking for and reviewing when attempting to determine the security impact of third party software. We discuss third party attestation and what to look for to ensure that we can have some level of trust that what the vendor promises are true. This is especially important when dealing with closed source software. And then we will take a look at the controls we should keep in mind when integrating new software into our environments. There are all sorts of threats that we need to be aware of when assessing or designing secured applications. We will cover those in this course. Of course, there are also vulnerabilities that we need to be mindful of as well.

      And last but not least, you will need to understand why and how these vulnerabilities can be exploited. Many security professionals may not have started their career as software developers, or even have any intention of becoming someone that writes code for a living. Most of the security professionals that I know of began as systems administrators or network engineers and then decided that they had a passion for security. They then pursued that passion and became security professionals in the security industry as it matured. With that in mind, all security professionals need to understand that there are many types of programming languages. A CISSP is not expected to be proficient at writing code or creating applications. Still, they are expected to understand the technology to the degree that they can collect information from developers, look at process documentation, and know what types of security concerns are directly related to software development processes and applications.

      We will then talk a little bit about object-oriented programming concepts, and finish that section off with distributed programming methodologies. In the Secure Coding and Security Control Concepts section of the course, we will discuss what it means to have a secure architecture for your applications, what some development best practices are, and basic design principles that everyone should be aware of. Also, throughout this course, we will be talking about many, many different concepts. The CISSP is based on a broad set of knowledge that spans many different domains and attempts to certify the types of knowledge that a working security professional should have picked up over time while working. In this module, we covered the purpose of this course, which is to prepare for the CISSP software development security domain, we looked at the various topics that will need to be covered, such as programming languages. Now we can move forward and start the course in the next module in which we will discuss application security concepts, and provide the necessary foundation that much of the material in the course is built upon. 

      Application Security

      Overview

      In this module, we will review Application Security as it relates to ISC-squared's CISSP software development security domain. Often, people seem to place a large portion of their security focus on network and system-level security controls. Many of these are tools that are designed to prevent or protect from a particular type of threat. With application development security, we get the opportunity to ensure that security is considered at the most important place of all, in the development of software. In this course, we are going to discuss the role of application security and why security practitioners and developers alike should care about application development. We will discuss governance methodologies, and the development controls, change control, and available versioning options. We also take a look at the fact that well-defined and improved processes lead to cleaner code and applications with fewer vulnerabilities, and what we should be concerned with in regards to the employees that have access to development resources, such as source code. 

      The Importance of Application Security

      Software is used to run our hardware, provide us with information, and to do anything that we want to do with modern technology. There are billions of electronic devices in the world, and the one thing that all of these devices have in common is that they all use some sort of software. This domain is all about making sure that that software is designed with security in mind. There was a time where news about breaches and information security were rare. That is no longer the case. You are almost guaranteed to hear about a new breach or new security vulnerabilities on the mainstream news networks, and if you work in the information technology security field, you are probably already inundated with your friends and family seeking advice on how they can better protect themselves from these horrible vulnerabilities that they hear about daily. For instance, taking a look at a statement released at DataLossDB.org, you can find that by mid-year in 2014, there were already reports of 502 million records exposed. If these trends continue, it will just be a matter of time before many just automatically expect their private information to be compromised. Some of the big vulnerabilities that were announced shortly before this recording included ShellShock. This particular vulnerability is said to have been around for nearly 20 years. The thing to remember about vulnerabilities is that their announcement date does not necessarily mean that no one else knew about the vulnerability. It just means that no one has reported it until now.

      Another example would include Heartbleed. This vulnerability was not around for nearly as long as ShellShock, but it is the perfect example of how even the software that we use to protect ourselves can be susceptible

      Enjoying the preview?
      Page 1 of 1