Secure Software Development Lifecycle

Question 1

what is ms sdl?

Answer 1

microsoft security development lifecycle

Question 2

what are the goals of ms sdl

Answer 2

• Increase reliability of software

- Reduce maintenance costs

Question 3

name the 7 phases of ms sdl

Answer 3

1. Training
2. Requirements
3. Design
4. Implementation
5. Verification
6. Release
7. Response

Question 4

name the 12 practices of ms sdl

Answer 4

1. Provide training
2. Define security requirements
3. Define metrics and compliance reporting
4. Perform threat modeling
5. Establish design requirements
6. Define and use cryptography standards
7. Manage the security risk of using third-party components
8. Use approved tools
9. Perform static analysis security testing (SAST)
10. Perform dynamic analysis security testing (DAST)
11. Perform penetration testing
12. Establish a standard incident response process

Question 5

liability: why is version control suitable as evidence?

Answer 5

Everything necessary to reproduce
-source code
-images, initial values, configuration
Version control systems
-Log modifications, history
-Roll back mistakes, attacks
Applicable
-Traditional development
-Configuration of hosted services, infrastructure as code

Question 6

Why should you sign your code?

Answer 6

Prove origin (authenticity) + integrity of transfer

Validity of certificate