Secure Software Development and Testing

Secure Software Development and Testing

1. Security Testing

   • Application Security Testing
     • Static (SAST)
     • Dynamic (DAST)
       • Fuzzing
         • Protocol Fuzzer
         • File Format Fuzzer
         • Application Fuzzer
       • Penetration Testing
     • tools
       • Software Composition Analysis (SCA)
       • API Testing
       • Application Security Posture Management (ASPM)
       • Container Security
       • Interactive AST (IAST)
       • Infrastructure-as-code (IaC) Testing
       • Mobile AST (MAST)
       • Software Supply Chain Security (SSCS)
   • Security Code Review
     • Manual
     • Automatic

2. Security Principles

   • Access Control
   • Risk Management
     • Plan Risk Management
     • Identify Risks
       • Assets
       • Threats
       • Vulnerabilities
     • Risk Analysis
       • Qualitative
       • Quantitative
     • Risk Response
       • Risk Acceptance
       • Risk Avoidance
       • Risk Mitigation
       • Risk Transfer
     • Monitor Risks
   • CIA
   • Protection

3. Secure Software Development

4. Secure Coding

   • Secure Coding Guidelines
     • Prevent DoS
     • Prevent Confidential Information Leakage
     • Prevent Injection and Inclusion attacks
     • Accessibility and Extensibility
     • Input Validation
     • Mutability
     • Object Construction
     • Serialization and Deserialization
     • Access Control
   • Rules/ Standards
     • Common Weakness Enumeration (CWE)
     • Common Vulnerabilities and Exposures (CVE)
     • CERT C Coding Standard
     • Motor Industry Software Reliability Association (MISRA)
   • Code Metrics Coverage
     • Statement Coverage
     • Decision Coverage
     • Condition Coverage
     • Multiple Condition Coverage
     • Path Coverage
     • Function Coverage
     • Call Coverage
     • Condition/ Decision Coverage