CCT 159: Practice CISSP Questions - Assess the Effectiveness of Software Security (Domain 8.3)

Ready to fortify your software development practices against security risks? Join us as we unearth critical strategies for mitigating vulnerabilities in your code. From the seamless integration of Static Application Security Testing (SAST) into your CI/CD pipelines to refactoring code to eliminate buffer overflow issues, this episode is packed with essential insights. Discover the must-have security controls for cloud-based SaaS platforms, such as robust access controls and code obfuscation techniques. We also delve into risk assessment methodologies like FMEA, STRIDE threat modeling, and OWASP’s top 10 web application security risks, equipping you with the tools to identify and prioritize threats effectively.

But that's not all—our conversation extends into the realm of secure coding best practices within a DevSecOps environment. Timely feedback on vulnerabilities is crucial, and we’ll show you how to integrate SAST tools into your continuous integration pipeline effectively. Learn why relying on security through obscurity is a pitfall and why thorough security assessments are vital when outsourcing software development. We emphasize the importance of automated code reviews and proper developer training to enhance software security. Finally, we share a heartfelt segment on the impact of adoption and the invaluable support our non-profit organization offers to adoptive families. Tune in for an episode that blends technical prowess with a commitment to making a positive social impact.

Gain access to 60 FREE CISSP Practice Questions each and every month for the next 6 months by going to FreeCISSPQuestions.com and sign-up to join the team for Free. That is 360 FREE questions to help you study and pass the CISSP Certification. Join Today!

Transcript

Speaker 1: 0:00

Welcome to the CISSP Cyber Training Podcast, where we provide you the training and tools you need to pass the CISSP exam the first time. Hi, my name is Sean Gerber and I'm your host for this action-packed, informative podcast. Join me each week as I provide the information you need to pass the CISSP exam and grow your cybersecurity knowledge. Alright, let's get started.

Speaker 2: 0:25

Let's go. Cybersecurity knowledge. All right, let's get started. Good morning, sean Gerber, with CISSP Cyber Training. Hope you all are having a wonderful day today. Today is CISSP Question Thursday. Today we're going to be talking about CISSP questions tied to Domain 8.3. And so we're going to focus on the aspects of that today, and you can get all these questions at cisspcybertrainingcom, along with all the video that goes along with it is all there, available, co-located for you, so it's ready for you to use anytime you want. And also know that anything you purchase at cisspcybertrainingcom goes to charity, as we're looking to deploy and grow our charity for adoptive families. So, again, anything you purchase at CISSP Cyber Training will go to our nonprofit for adoptive families.

Speaker 2: 1:12

I've got to put that plug out there. Just do Well. I hope you all are having a great day and I hope you all are staying cool. I know it's extremely hot out there, especially for the folks down in Texas. It's quite hot right now. A lot of them still don't have power folks down in Texas, it's quite hot right now. A lot of them still don't have power. So I hope you are all doing well and staying safe because, yeah, that's not good Heat sucks. It just truly does. It's not fun.

Speaker 2: 1:32

But let's get into question number one. Again, this is over domain 8.3. Question number one A company utilizes a continuous integration and continuous delivery pipeline for its software development plan. Which of the following security controls would be most effective in mitigating risks associated with code vulnerabilities A Static application security testing integrated into your CICD pipeline. B Dynamic application security testing performed during post deployment. C code reviews conducted by senior developers before merging the code. Or D application whitelisting on production servers. And the most effective? Again, what would be the most effective in mitigating the associated code vulnerabilities would be A static application security testing integrated into your pipeline. The more you can integrate into your CI CD pipeline, the much better it's going to be. I've seen very good results out of this. So any way that you can look for vulnerabilities in while it's in the CI CD pipeline, good call, really good call.

Speaker 2: 2:37

Question two during the code audit, the reviewer discovers a critical buffer overflow vulnerability. The developer argues that the vulnerability is not exploitable because the specific user input size required to trigger it would be highly unlikely to occur in a real-world usage. Which of the following is the most appropriate response? Again, the code auto-review Developer says nah, it's not a big deal because it's too unlikely that it's going to happen. What should you do? A accept the developer's explanation and move on. B implement input validation to prevent specific user input size. C refractor the code to eliminate the buffer overflow vulnerability entirely. Or. D conduct a risk assessment to determine the likelihood of the impact and exploitation. So obviously, b, c and D are all positive. A yeah, I don't know if I'd move it, accept it or not. You need to understand. Accepting is not bad, but you also need to have some validation behind it. The answer is C refractor the code and eliminate the buffer overflow vulnerability entirely. That's what you want to do because it's the most secure approach. Now you have to talk about it. You may decide, you know what, from a risk standpoint, you would just add a user input size change to that actual field, but in this case the refractor will take care of it completely.

Speaker 2: 3:53

Question three your company utilizes a cloud-based software development platform, called a SaaS platform, for building internal applications. Which of the following is most important security control to implement and to manage the risks associated with the code stored on this SaaS provider's infrastructure. Okay, so again, you've got cloud software development, you've got a SaaS environment. Which is the most important security control for your environment? A implement strong access controls within the SaaS platform for your developers. B regularly perform penetration controls within the SaaS platform for your developers. B regularly perform penetration testing of the SaaS provider's infrastructure. C requiring the SaaS provider to obtain a SOC 2 Type 2 compliance report. Or. D utilizing code obfuscation techniques to protect the source code on the platform. So which of these is the most important factor that you could do, the most important security control you could do, the most important security control you could do. Again, you're going to have to define what is best for you and you have to determine what is the most valuable risk. Obviously, utilizing code obfuscation d on that platform would be the idea of the most secure environment to reduce the most amount of risk, because if the code was stolen they wouldn't know. Know. The downside is that has a lot of drama potentially, so you may have to decide which way you want to go.

Speaker 2: 5:11

Question four you're tasked with implementing a risk management framework for your software development lifecycle, for your SDLC. Which of the following risk assessment methodologies is most appropriate to identify and prioritize the threats to your code? So, again, you're tasked with implementing a risk management framework for your software development lifecycle. Which is the most appropriate to identify and prioritize threats to your code? A failure mode and effective analysis, or failure mode and effects analysis? That's FMEA. B stride threat modeling. C OWASP, top 10 web application security risks or dcvss common vulnerability scoring system. So all of those are good, right, but which is the most appropriate to identify risk, identify and prioritize threats to your code? And owasp would be the top 10 web application security risk would be your first place to start. C Question five your company uses a centralized logging system to record all user activity related to code changes.

Speaker 2: 6:12

However, a recent security incident involved an attacker compromising a developer's credentials and modifying the critical code. Which of the following security controls could have the most effectively prevented this incident from occurring? So again, if a centralized logging records all user activity to code changes, however, a security incident involved an attacker compromising the developer's credentials and modifying the critical code, what could have been done to most effectively prevent this incident? A implement multi-factor authentication. B utilize role-based or RBAC for those specific code modules. C employing code signing and verifying integrity of the code commits. Or. D enabling continuous CI pipelines to automatically detect and revert malicious code changes and the answer is A. Mfa would be one of the best options you could do in this situation. It would definitely add an extra layer of security and, even though they got access to the credentials, hopefully they would not have access to the person's MFA token.

Speaker 2: 7:14

Question six your development team utilizes open source libraries in their code. Which of the following security controls is the most important to mitigate risk associated with vulnerabilities in these libraries A implement least privilege model for developer access to the code base. B regularly update all open source libraries to the latest versions. C perform static application security testing of the entire code base. Or. D manually review the source code of all utilized open source libraries. Again, your development team utilizes open source libraries in their code. Which of the following security controls is the most important to mitigate the risk associated with these vulnerabilities? And the answer is B regularly update all open source libraries to the latest versions.

Speaker 2: 8:00

Questions seven which of the following security testing methodologies is most effective in identifying vulnerabilities in the business logic of the software application? So which of the following security testing methodologies is most effective in identifying vulnerabilities in the business logic of a software application A Dynamic application security testingAST with fuzzing techniques. B penetration testing with focused on exploiting known vulnerabilities. C static application security testing SAST, with code analysis capabilities, or. D security code reviews conducted by senior developers. Okay, so which is the most effective in identifying vulnerabilities in business logic of a software application? Okay, begin business logic of the software application Security code reviews conducted by senior developers. D would be the best choice and the reason is because it's of that business logic. They would have understanding around the business logic and they would be able to understand how the software application conducts itself. But all the other ones are really good. They're all very, very good, but when you're dealing with business logic, that would be for the actual business. You need somebody with eyes on to understand it.

Speaker 2: 9:13

Question eight your company is developing a new mobile application that will store sensitive user data. Which of the following security controls should be prioritized during the design phase to minimize risks associated with the data breaches? Get your new mobile app You're developing with sensitive user data, what should you do? A implement strong access controls for user authentication within the app. B utilize data encryption at rest in transit for all sensitive data user data. B or C enforce strong password policies on all user accounts. Or. D conduct penetration testing in the completed mobile application. Again, all are very good, but you want to utilize encryption at rest and in transit for sensitive user data. B there might be compliance or regulatory requirements that are forcing you down this path as well.

Speaker 2: 10:01

Question nine you are implementing a vulnerability management program for your software development process. Which of the following activities is the lowest priority when addressing newly identified critical vulnerabilities in your code? So, again, you're implementing a vulnerability management program for your software development process. Which of the following activities is the lowest priority when addressing a newly identified critical vulnerability in your code? A immediately notify all relevant stakeholders and developers. B identify the root cause of the vulnerability and understanding its potential impact. C prioritize the vulnerability based on its severity and exploitability, or d patch the vulnerability based on its severity and exploitability. Or D patch the vulnerability in a test environment before deploying to production. Okay, lowest priority patching the vulnerability in a test environment. Testing is important, but it's because it is a critical patch. You need to get it out there and let everybody know. So again, that is an interesting environment. You just need to kind of think about that. A lot of people will deploy to test and patch it there first, just to make sure, but if it's that critical you may need just to get it out there and just see what happens.

Speaker 2: 11:04

Question 10, your company utilizes security information and event management systems, siem. Okay, we talk about the SIEM a lot on CISSP, cyber Training System to aggregate and analyze logs from various security tools. Which of the following is the most important consideration when configuring log retention of a SIM system A Maximizing log storage capacity to retain detailed logs for extended periods. B Balancing log retention needs with storage limitations and regulatory compliance requirements. C Setting up the same log retention period for all security tools integrated with the SIM. Or. D focusing on real-time analysis of logs and discarding historical data. So the most important consideration when configuring log retention for a SIM is B balancing log retention needs with storage limitations and regulatory compliance requirements. Yeah, because it can get very expensive and your regulatory people may have questions and they may have additional storage requirements that you may not want to do but you have to do.

Speaker 2: 12:02

Question 11, your company is implementing a DevSecOps approach to integrate security throughout the software development lifecycle. Which of the following security controls is the most effective for ensuring developers receive a timely feedback on potential vulnerabilities in their code? Receive a timely feedback on potential vulnerabilities in their code. So again, devsecops. They're determining the software development lifecycle. Which of the following is the most effective in ensuring developers receive timely feedback on potential vulnerabilities in their code? A security code reviews conducted at the end of the development sprint. B integrating static application security testing SAST tool to the continuous integration pipeline. Static application security testing SAST tool to the continuous integration pipeline. B or D conducting penetration tests on pre-production environments. Or D providing developers with security awareness training. Okay, the most effective. Which one is the most effective? Again, all those are good, but the most effective is B integrating static application testing into your CICAD pipeline.

Speaker 2: 12:58

Question 12. During a code audit, a reviewer discovers a potential security flaw in a custom authentication mechanism. The developer argues that the flaw is a security through obscurity, which we know works really well, technique that is not a real vulnerability. Which of the following is the most appropriate response? Okay, so security through obscurity Accept the developer's explanation if no known exploits exist in the flaw. B explain that security through obscurity is not a reliable security control. C refractor authentication mechanism to eliminate any potential security flaw. Or D conduct a penetration test to determine if a flaw can be exploited. And the most appropriate is hey, dude, you know what. Security through obscurity isn't really that good of a thing to do. It just really isn't, doesn't work. Don't try it Doesn't work. They figure it out, they're smart.

Speaker 2: 13:50

Question 13. Your company plans to outsource the development of a critical software application. Which of the following security controls is most appropriate to or most important to implement when it's considering a potential vendor? So a company plans to outsource its development of critical software application. Probably not a good idea. I would avoid it. A and require the vendor to provide a sock to type 1 compliance report. B. Conducting a security assessment of the vendor to provide a SOC 2 Type 1 compliance report. B. Conducting a security assessment of the vendor's development environment. C specifying detailed security requirements in the development contract. Or. D implementing code reviews on all code delivered by the vendor. Okay, the last one good idea, but that would take way too much work. So, when it comes down to it, what would you do?

Speaker 2: 14:35

Well if they're going to be developing it for you, you want to do a full security assessment of their development environment, which may include you going on site to understand it. Been there, done that, got the t-shirt. So you may have to do that Something to consider, especially if they're doing outsourcing of your code. I do not recommend it as much as you possibly can unless they have a rock solid system that you can audit and that you know feel comfortable. Comfortable with that they will do.

Speaker 2: 15:00

Question 14 which of the following security best practices is most relevant when designing software development process that process prioritizes secure coding practices? Okay, again, security best practices which is most relevant when designing software development processes that prioritize secure coding practices? That's a lot of P's. There's a lot of P's in that question. A implement the least privileged model for developer access to production environments. B utilize automated code reviews with static application security testing. C enforce strong password policies for developer accounts. Or D provide developers with secure coding training and resources. Okay, the most relevant is utilize automated code reviews. Again, I talked about it. Utilize them as much as you possibly can because, again, they will help make your life so much easier.

Speaker 2: 15:51

Question 15, the last melon. If you know the movie for extra credit. Which of the following activities is the least effective approach for identifying and prioritizing security risks associated with new software? Again, the least effective approach with identifying and prioritizing security risks for new software applications? A conduct a threat modeling exercise to identify potential attack vectors. C perform a vulnerability scan on the completed application to identify known vulnerabilities. C review industry best practices and security recommendations for similar applications. Or. D utilizing a checklist of generic security controls to identify potential weaknesses. So which one is the least effective? Yeah, you got it. D. Checklist of generic security controls to identify potential weaknesses. So which one is the least effective? Yeah, you got it. D. Checklist of generic security controls. Yeah, that's great, but it's not going to work so well. Again, up to you. You decide what you want to do and all right, that's all I've got for you today.

Speaker 2: 16:44

Head on over to CISSPcybertrainingcom. Again, I got some great free materials there. There's awesome free stuff, but there's also if you purchase, like my bronze package or any of the other packages. Obviously all of that funding goes to our local charity that we're creating. It's a non-profit that's set up specifically for adoptive families, parents who want to adopt children and they, financially, are struggling to do so. We are offering an opportunity for them to be able to get a potentially low interest loan or potentially a grant, depending upon the need and the situation. Again, not everybody will be able to qualify, not everybody will qualify, not everybody will get a loan, but the bottom line is it's designed specifically for families that are struggling that may need a little bit of extra help, to help adoptive parents and bring kids into loving and caring families. That's the ultimate goal.

Speaker 2: 17:33

There's a lot of kids out there that got nothing. They got nothing at all, and having an adoptive family to help them, to grow them and I've seen this firsthand with my kids it isn't always rainbows and unicorns and sunshine it's not, but it is a wonderful opportunity and my kids are well-blessed and I'm and I'm well blessed for the fact that we did this for them. Again, god gave this to us, gave us the opportunity to do it, and it's been a blessing to both of us, to all my kids and to my wife and myself. So if you are interested in some training, you can get. Again, all of that is going to our non-profit and we greatly appreciate any and all support for this endeavor. All right, have a wonderful day, just have a great day, and we greatly appreciate any and all support for this endeavor. All right, have a wonderful day, just have a great day, and we will catch you on the flip side, see ya.