Secure Software Development and Testing - created from Mind Map

Page 1

Security Testing

Security Principles

Secure Software Development

Secure Coding

Application Security Testing

Security Code Review

Static (SAST)

Dynamic (DAST)

tools

Fuzzing

Penetration Testing

Protocol Fuzzer

File Format Fuzzer

Application Fuzzer

Software Composition Analysis (SCA)

API Testing

Application Security Posture Management (ASPM)

Container Security

Interactive AST (IAST)

Infrastructure-as-code (IaC) Testing

Mobile AST (MAST)

Software Supply Chain Security (SSCS)

Manual

Automatic

Access Control

Risk Management

CIA

Protection

Plan Risk Management

Identify Risks

Risk Analysis

Risk Response

Monitor Risks

Assets

Threats

Vulnerabilities

Qualitative

Quantitative

Risk Acceptance

Risk Avoidance

Risk Mitigation

Risk Transfer

Secure Coding Guidelines

Rules/ Standards

Code Metrics Coverage

Prevent DoS

Prevent Confidential Information Leakage

Prevent Injection and Inclusion attacks

Accessibility and Extensibility

Input Validation

Mutability

Object Construction

Serialization and Deserialization

Access Control

Common Weakness Enumeration (CWE)

Common Vulnerabilities and Exposures (CVE)

CERT C Coding Standard

Motor Industry Software Reliability Association (MISRA)

Statement Coverage

Decision Coverage

Condition Coverage

Multiple Condition Coverage

Path Coverage

Function Coverage

Call Coverage

Condition/ Decision Coverage