Secure-Software-Design WGU Secure Software Design (D487, KEO1) Exam Questions and Answers

The secure coding best practice that emphasizes treating all incoming data as untrusted and subjecting it to validation is known as input validation. This practice is crucial for ensuring that a system only processes valid, clean data, thereby preventing many types of vulnerabilities, such as SQL injection, cross-site scripting (XSS), and buffer overflows, which can arise from maliciously crafted inputs.

Input validation involves verifying that the data meets certain criteria before it is processed by the system. This includes checking for the correct data type, length, format, and range. It also involves sanitizing the data to ensure that it does not contain any potentially harmful elements that could lead to security breaches.

A centralized input validation routine is recommended for the entire application, which helps in maintaining consistency and effectiveness in the validation process. This routine should be implemented on a trusted system, typically server-side, to prevent tampering or bypassing of the validation logic.

It’s important to classify all data sources into trusted and untrusted categories and to apply rigorous validation to all data from untrusted sources, such as user input, databases, file streams, and network interfaces.

By adhering to the input validation best practice, developers can significantly reduce the attack surface of their applications and protect against a wide array of common security threats.

The practice described is Code review, which is a part of secure software development best practices. Code reviews are conducted to ensure that the code adheres to accepted coding patterns and meets the team’s quality standards. This process involves the examination of source code by a person or a group other than the author to identify bugs, security vulnerabilities, and ensure compliance with coding standards.

Penetration testing is an activity where a simulated attack is performed on a software product to identify vulnerabilities that could be exploited by attackers. It is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely trying to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and risky end-user behavior. In the context of the Ship phase of the Security Development Lifecycle (SDL), penetration testing is conducted as a final check to uncover any potential security issues that might have been missed during previous phases. This ensures that the software product is robust and secure before it is released.

The phase being described is the Deployment phase of the SDLC. This phase involves making the software available for use by customers after it has been developed, tested, and approved for release. It includes the installation of the software in the production environment, ensuring that all features are operational as intended, and obtaining formal approval from leadership to proceed with making the product available to end-users. The deployment phase is critical as it transitions the software from a development setting to a real-world operational environment.

The issue described involves a session management vulnerability where the user’s session remains active even after the browser window is closed, allowing another user on the same machine to access the application without logging in. To prevent this security risk, it’s essential to adjust the session management controls to include an automatic timeout feature. This means that after a period of inactivity, or when the browser window is closed, the session should automatically expire, requiring a new login to access the application. This adjustment ensures that even if a user forgets to log out, their session won’t remain active indefinitely, reducing the risk of unauthorized access.

The Common Vulnerability Scoring System (CVSS) uses the following ranges to determine the severity rating of a vulnerability:

0.1 - 3.9: Low severity

4.0 - 6.9: Medium severity

7.0 - 8.9: High severity

9.0 - 10.0: Critical severity

Since the adjusted score for the vulnerability is 5.9, it falls within the High severity range.

Comprehensive and Detailed In-Depth Explanation:

The scenario describes a stage where the developed features are deployed to a pre-production environment for verification by analysts. This aligns with the Testing phase of the Software Development Life Cycle (SDLC).

In the Testing phase, the system undergoes various evaluations to ensure it meets the specified requirements and functions correctly. This includes deploying the software in an environment that simulates production to identify and rectify defects before the actual deployment. The primary goal is to validate the software's quality and performance.

According to the SDLC framework, after the development (coding) phase, the next step is Testing, where the system is rigorously evaluated. This phase is crucial to detect issues that may not have been apparent during development and to ensure that the software operates as intended in a controlled setting before live deployment.

The secure coding best practice that requires authentication before allowing any files to be uploaded, and limits the types of files to only those needed for the business purpose, falls under the category of File Management. This practice is crucial for preventing unauthorized file uploads, which can be a common vector for attacks such as uploading malicious files or scripts. By enforcing authentication, the application ensures that only legitimate users can upload files. Additionally, restricting the file types to those necessary for business operations minimizes the risk of uploading potentially harmful files that could compromise the system.

Comprehensive and Detailed In-Depth Explanation:

The Open Web Application Security Project (OWASP) Software Assurance Maturity Model (SAMM) is a framework designed to help organizations assess and improve their software security posture. SAMM is structured around five primary business functions: Governance, Design, Implementation, Verification, and Operations.

In this scenario, the focus is on reviewing design artifacts to ensure compliance with organizational security standards. This activity aligns with the Verification business function within SAMM. The Verification function encompasses security practices related to assessing and validating the security of software artifacts throughout the development lifecycle. Key practices under this function include:

Design Review: Evaluating design documents and models to identify potential security issues and ensure that security requirements are adequately addressed.

Code Review: Analyzing source code to detect security vulnerabilities and ensure adherence to secure coding standards.

Security Testing: Conducting various testing methodologies, such as penetration testing and vulnerability scanning, to identify and remediate security weaknesses in the software.

By focusing on the Verification function, the organization aims to proactively identify and address security concerns during the design and development phases, thereby enhancing the overall security posture of their software products.

A threat profile is a security assessment deliverable that identifies possible security vulnerabilities in a product. It involves a systematic examination of the product to uncover any weaknesses that could potentially be exploited by threats. The process typically includes identifying the assets that need protection, assessing the threats to those assets, and evaluating the vulnerabilities that could be exploited by those threats. This deliverable is crucial for understanding the security posture of a product and for prioritizing remediation efforts.

 Data flow analysis is a manual code review technique where the reviewer traces the path of data from its entry point in the software (input control) through its processing and manipulation within the application, to its exit points (outputs). This technique is used to ensure that the data is handled securely throughout its lifecycle within the application and to identify any potential security vulnerabilities that may arise from improper data handling or processing12

Comprehensive and Detailed In-Depth Explanation:

The scenario outlines the process of decommissioning a legacy application after a new product has successfully taken over its functions. This corresponds to the End of Life phase in the Software Development Life Cycle (SDLC).

The End of Life phase involves retiring outdated systems and transitioning users to newer solutions. This phase ensures that obsolete applications are systematically phased out, reducing maintenance costs and potential security vulnerabilities associated with unsupported software.

In this case, running both the legacy and new applications concurrently provided a safety net to ensure the new system's stability. After confirming the new product's reliability, the organization proceeds to disable the legacy system, marking its End of Life.

The secure coding practice being described is Access Control. This practice ensures that access to data and features within a system is restricted and controlled. The description given indicates that the product has mechanisms to prevent the display of personally identifiable information (PII), restrict the printing of private documents, and require elevated privileges to access archived documents. These are all measures to control who has access to what data and under what circumstances, which is the essence of access control.

The OpenSAMM business function being assessed is Verification. This function involves activities related to reviewing and testing to ensure that the software meets the required security standards and practices. In the context of the question, the software security group’s focus on reviewing design artifacts to ensure compliance with organizational security standards falls under the Verification function. This includes tasks such as design review, implementation review, and security testing, which are all aimed at verifying that the security measures and controls are correctly integrated into the software design.

Comprehensive and Detailed Explanation From Exact Extract:

The Iterative software development model fits this description. It involves specifying and implementing a portion of the software, reviewing it, gathering feedback, and refining or adding requirements in successive cycles. This approach supports evolving requirements and continuous improvement. Iterative models contrast with Waterfall (C), which is linear and sequential, with no repetition of phases. “Code and fix” (D) is an informal, ad hoc process lacking formal review cycles. Implementation (B) is a phase, not a model. The iterative approach is advocated in ISO/IEC 12207 and NIST guidelines for secure development, as it allows early detection and remediation of security issues by incremental design and testing.

Comprehensive and Detailed In-Depth Explanation:

ISO/IEC 27001 is an international standard that outlines the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Achieving ISO 27001 certification demonstrates an organization's commitment to information security and provides assurance to customers and stakeholders that security best practices are in place.

In the context of the software development life cycle (SDLC), post-release certifications refer to obtaining formal certifications, such as ISO 27001, after a product has been developed and released. This process involves a comprehensive assessment of the organization's information security practices to ensure they align with the standards set forth by ISO 27001. The certification process typically includes:

Gap Analysis: Evaluating existing information security measures against ISO 27001 requirements to identify areas needing improvement.

Implementation: Addressing identified gaps by implementing necessary policies, procedures, and controls.

Internal Audit: Conducting internal audits to verify the effectiveness of the ISMS and readiness for external assessment.

External Audit: Engaging an accredited certification body to perform a thorough evaluation, leading to certification if compliance is demonstrated.

By pursuing ISO 27001 certification post-release, the company aims to enhance its security posture, comply with international standards, and build trust with its customer base.

The step of the PASTA threat modeling methodology where the team will capture infrastructure, application, and software dependencies is the Define technical scope step. This step involves detailing the technical elements of the project, which includes understanding and documenting the infrastructure, applications, and software dependencies that are critical to the system’s operation and security.

The issue described involves a PATCH request causing an unhandled server exception because the API does not support this method. The most direct and effective way to prevent such exceptions is to ensure that the API is configured to accept only the supported request methods: GET, POST, PUT, and DELETE. This can be achieved by implementing strict input validation to reject any requests that do not conform to the defined API specifications, including the request method. By doing so, any requests using unsupported methods like PATCH will be immediately rejected, thus preventing the server from reaching an exception state.

 The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC).

Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.

Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.

Availability ensures that information and resources are accessible to authorized users when needed. This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.

By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.

Fuzzing is an automated or semi-automated software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program1. This process is designed to uncover coding errors, security vulnerabilities, and other potential issues within the software by observing how it behaves under unexpected or malformed inputs. Fuzzing is particularly effective because it can expose corner cases that have not been properly dealt with and can be used to test programs that take structured inputs, such as file formats or protocols2.

Manual peer review refers to the systematic examination of software source code by developers other than the original author. This practice is recognized as a valuable tool for reducing software defects and improving the quality of software projects. It involves developers inspecting the code to find and fix mistakes overlooked in the initial development phase, which enhances both the overall quality of software and the developers’ skills. Peer code review is less formal and more “lightweight” than the code inspections performed in the past, and it provides benefits such as knowledge transfer, increased team awareness, and creation of alternative solutions to problems.

Comprehensive and Detailed In-Depth Explanation:

Engaging an independent security consulting firm to simulate attacks on deployed products is an example of Penetration Testing.

Penetration testing involves authorized simulated attacks on a system to evaluate its security. The objective is to identify vulnerabilities that could be exploited by malicious entities and to assess the system's resilience against such attacks. This proactive approach helps organizations understand potential weaknesses and implement necessary safeguards.

According to the OWASP Testing Guide, penetration testing is a critical component of a comprehensive security program:

"Penetration testing involves testing the security of systems and applications by simulating attacks from malicious individuals."

The term ‘availability’ in the context of Secure Software Development Lifecycle (SDL) refers to ensuring that systems, applications, and data are accessible to authorized users when needed. This means that the information must be timely and reliable, without undue delays or interruptions. Availability is a critical aspect of security, as it ensures that the software functions correctly and efficiently, providing users with the information they need to perform their tasks.

The Intelligence domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization’s ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain.