Domain 8: Software Development Security
Lifecycle models
| Model | Signature |
|---|---|
| Waterfall | linear phases, requirements frozen early |
| Spiral | iterative loops, risk-driven |
| Agile | sprints, evolving requirements, working software |
| RAD | rapid prototyping, user feedback |
| DevSecOps | CI/CD + security shifted left, automation in pipelines |
DevSecOps essentials: pipeline SAST/DAST/SCA gates, IaC and container image scanning, secret scanning, SBOM generation, signed artefacts.
Secure SDLC stages
Requirements (security + privacy requirements, misuse cases) → Design (threat modelling, attack surface reduction, architecture review) → Development (coding standards e.g., SEI CERT; peer review; static analysis in IDE) → Testing (dynamic, fuzz, regression) → Release (signing, change approval) → Maintenance (patching, dependency updates, bug bounty). Maturity models: OWASP SAMM, BSIMM; CMM/CMMI levels 1–5.
Programming fundamentals worth points
- Compiled vs interpreted; strong vs weak typing; managed runtimes.
- OOP: encapsulation, inheritance, polymorphism; high cohesion good, tight coupling bad.
- Memory safety: buffer overflows → bounds checking, DEP/NX, ASLR, stack canaries, safe languages.
- Input handling: allow-list validation > block-list; canonicalisation; output encoding.
The web attack playbook (attack → defence)
| Attack | Defence |
|---|---|
| SQL injection | parameterised queries/prepared statements, least-privilege DB accounts, ORM |
| XSS (reflected/stored/DOM) | output encoding, CSP, HttpOnly+Secure cookies, sanitisation |
| CSRF | anti-CSRF tokens, SameSite cookies, re-auth for sensitive actions |
| SSRF | allow-list egress, disable redirect follow, metadata-service blocking |
| Insecure deserialisation | never deserialize untrusted data; signed/integrity-checked payloads |
| API abuse | per-endpoint authorisation, rate limiting, schema validation (REST/GraphQL) |
Databases
ACID: Atomicity (all-or-nothing), Consistency (valid states), Isolation (concurrent tx don't clash), Durability (committed = survives crash). Normalisation removes redundancy; views restrict column/row exposure. Threats: aggregation and inference from combined harmless rows → counter with polyinstantiation, noise, access controls. Connections via ODBC/JDBC; NoSQL and DW/big-data variants exist.
Software supply chain & third parties
- Software escrow for vendor bankruptcy protection.
- Third-party libraries: SCA, pin versions, review licenses, SBOM (CycloneDX/SPDX).
- Code repositories: protected branches, signed commits, secret scanning; never hardcode keys — vault + rotation.
- COTS vs custom: vendor patches vs your SDLC; both need inventory.
- Malware concepts: virus/worm/trojan/ransomware/logic bomb; antimalware + application allow-listing (the stronger control).
Effectiveness measurement
Track: defect density, escape rate, % builds passing security gates, time-to-remediate, coverage of critical paths. Independent testing (external pen test or audit) validates internal claims; separation between dev, test and prod environments (no prod data in test!).
Memory hooks
- Spiral = risk-driven; Agile = sprint-driven; Waterfall = document-driven.
- SQLi → prepared statements; XSS → output encoding + CSP; CSRF → tokens + SameSite.
- ACID = Atomicity, Consistency, Isolation, Durability.
- Shift left = find bugs earlier = cheaper.
- Aggregation/inference → polyinstantiation & tight views.
Exam tips
- Pick defences by attack name — the pairing is nearly always the tested point.
- ‘Best input validation approach’ = allow-list (deny by default).
- Dev vs test vs prod separation: developers must not push unreviewed code to prod.
- Maturity/model questions: SAMM/BSIMM = software assurance maturity; CMMI = process.