3550 Chapter 8

Environment

An environment is the collection of hardware and software used to build an application.

Development Environment / Dev

The environment where an application is created, debugged, modified, and improved.

Test Environment / Test

The environment where an application is tested against the application's specification requirements.

Staging Environment / Stage

The software environment after an application is developed and tested but before it is released.

Production Environment / Prod / Live Environment

An environment where the release version of an application is deployed and made available to the application's users.

Quality Assurance / QA

The process of testing an application's various aspects, including an application's stability, usability, security, functionality, and performance to ensure that the application meets user requirements.

What are the four standard deployment environments in software development?

1- Development

2- Testing

3- Staging

4- Production

Code Signing

The act of digitally signing software by the software's publisher.

Deprovisioning

The process of removing an application from a production environment.

Software Versioning

The process of assigning names or numbers to unique states of released software.

Version / Source Control

The practice of tracking and managing a software's versions.

Secure Coding / Programming

The practice of developing software in a way that minimizes the risk of creating software vulnerabilities.

Secure Coding Techniques

Methods designed to improve code security.

Obfuscation / Camouflage

A secure coding technique which makes code difficult to read and harder to understand by modifying the code appearance.

Code / Software Reuse

The use of existing software to build new software.

Dead Code

Code that can never be executed at run-time, or is executed but whose result is never used in any other computation.

Third-Party Library

A reusable software component developed by an entity outside of the development platform.

Software Development Kit (SDK)

A collection of software development tools in one package.

Sandboxing

A security practice involving the creation of a separate, isolated environment, referred to as a sandbox, to test and execute untrusted or unknown code, applications, or files without harming the main system or network.

Elasticity

The degree to which a system is able to adapt to workload changes by automatically provisioning and deprovisioning resources.

Scalability

The measure of a system's ability to handle increased demands.

Horizontal Scalability

Scalability which entails adding new servers to an existing infrastructure.

Vertical Scalability

Scalability which entails adding resources to existing systems.

Software Diversity

The practice of creating diversity within the software development process with the aim of reducing the extent of software vulnerability exploits.

Data Exposure

The intentional or unintentional disclosure of information to an unauthorized user or application.

Database Normalization

The process of organizing data in a relational database.

Stored Procedure

A group of SQL statements created to perform a specific task.

Parameterized Query

A query in which placeholders are used for parameters and the parameter values are supplied at execution time.

Column-Level / Columnar Encryption

Selective encryption configured on a specified database table column or columns.

Record-Level Encryption

Selective encryption configured on all instances of a specified database table record.

Salting

The process of adding a unique string of characters, known as salt, to a password before hashing the password.

Rainbow Table

A precomputed table of hashes for common passwords.

Sender Policy Framework (SPF)

An email authentication system that ensures the sending mail server is authorized to send emails from the sender's domain.

DomainKeys Identified Mail (DKIM)

An email authentication method that uses digital signatures to verify that an email was sent and authorized by the owner of the sending domain.

Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

An email authentication protocol that secures email communications by verifying sender identities, specifying actions for authentication failures, and providing reports on email delivery and integrity.

Email Gateway

A server that processes an organization's incoming and outgoing email to protect the organization's internal servers.

Code Review

The process of systematically examining code with the aim of improving code quality.

Dynamic Code Analysis

A code review method that examines code during the code execution.

Static / Source Code Analysis

A code review method that examines code without executing the code.

Manual Code Review

The process of performing static code analysis by one or more code reviewers.

Package Monitoring

The practice of systematically tracking and managing various elements within a software project.

Fuzzing / Fuzz Testing

A testing technique for finding software bugs and vulnerabilities by feeding invalid and random data into software.

Fuzzer

A program that automatically generates random data for software testing.

Development Operations / DevOps

A set of practices and tools that automate and integrate software development and IT operations.

Continuous Integration

The practice of frequently merging new and modified code from multiple developers into a single project.

Continuous Delivery

The practice of frequently releasing new software that is ready to be deployed into a stage environment.

Continuous Deployment

The practice of frequently deploying new software into a production environment.

Continuous Validation

The practice of frequently verifying that new and existing software is tested.

Continuous Monitoring

The practice of frequently monitoring released software to detect errors, security risks and compliance issues.

Open Web Application Security Project (OWASP)

The open web application security project (OWASP) is a non-profit foundation that publishes methodologies, documentation, tools, and technologies for raising awareness and improving web application security.

Web Application Security

The set of practices and technologies that enable the creation of secure web applications.

OWASP Top 10

A regularly-updated list of the 10 most common web application security risks.

Input Validation

A secure coding technique that ensures only valid input is entered into software.

Allow List / White List

A list used for input validation that ensures an input matches a set of known good values.

Block List / Deny List

A list used for input validation method that ensures an input does not contain known bad values.

Server-Side Validation

Input validation that is performed by a server after input has been sent to the it.

Client-Side Validation

Input validation that is performed by a client before input is sent to a server.

Secure Cookie

A cookie with the Secure attribute, which requires the cookie to be transmitted over secure channels like HTTPS.