Software Software Engineering

What are the three principles of the CIA Triad?

Confidentiality, Integrity, Availability

What is the main goal of Secure Software Engineering?

To develop software that is reliable, scalable, and resistant to attacks.

What are the key security considerations in the SDLC?

1. Requirement Analysis: Identify security needs early. 2. Design: Use secure architecture & threat modeling. 3. Implementation: Follow secure coding practices (OWASP Top 10). 4. Testing: Conduct penetration testing, static analysis. 5. Deployment & Maintenance: Apply security patches regularly.

What is the main weakness of the Waterfall Model in security?

Security is considered late in development, making it harder to fix vulnerabilities.

Why is the V-Model good for security?

Security verification and validation are done at every phase, making it effective for safety-critical systems.

What is DevSecOps?

DevSecOps integrates security practices into the development and operations process to ensure continuous security testing.

How does Agile development handle security?

Security must be integrated into each sprint, with automated testing, threat modeling, and security reviews as part of development.

What is the difference between Use Cases and Misuse Cases?

Use Case: Describes how a system should function normally. Misuse Case: Describes how an attacker could exploit vulnerabilities.

What is the best way to prevent SQL Injection?

Use prepared statements and input validation to sanitize database queries.

What is Multi-Factor Authentication (MFA)?

A security measure that requires multiple forms of verification (e.g., password + fingerprint).

What are common software security threats?

1. SQL Injection – Use input validation & prepared statements. 2. XSS (Cross-Site Scripting) – Sanitize user inputs & use CSP. 3. DoS Attack – Implement rate limiting & firewalls. 4. Phishing – Train users & enforce MFA. 5. Buffer Overflow – Use safe coding practices.

What are the benefits of Security Testing?

1. Identifies vulnerabilities before attackers do. 2. Ensures compliance with security policies (e.g., GDPR, HIPAA). 3. Reduces the cost of fixing security flaws later in development.

What is Kanban?

A visual workflow management method that focuses on continuous delivery and work-in-progress limits.

What are the key security practices in Kanban?

1. Security Tasks Always Visible – Create a security-focused column. 2. Continuous Security Testing – Regular penetration testing. 3. Prioritize Security Fixes – Address high-risk vulnerabilities first. 4. Security Reviews – Conduct regular audits.

What is the biggest lesson from the Equifax Data Breach?

Unpatched vulnerabilities led to 147 million records being leaked, proving the importance of regular software updates.

What are some security testing methods?

1. Static Code Analysis – Scans source code for security flaws. 2. Penetration Testing – Simulates hacker attacks. 3. Fuzz Testing – Sends random inputs to check for crashes. 4. Access Control Testing – Ensures unauthorized users cannot access sensitive data.

What is Role-Based Access Control (RBAC)?

A security model where access permissions are assigned based on a user’s role in the organization.

Why is Patch Management important?

Patching software regularly fixes known vulnerabilities before attackers exploit them.

What is the "Principle of Least Privilege"?

Users and applications should only have access to the minimum necessary data and permissions to perform their tasks.