Software Software Engineering

1. What are the three principles of the CIA Triad?

✅ Confidentiality, Integrity, Availability

2. What is the main goal of Secure Software Engineering?

✅ To develop software that is reliable, scalable, and resistant to attacks.

3. What are the key security considerations in the SDLC?

✅ Requirement Analysis: Identify security needs early.

✅ Design: Use secure architecture & threat modeling.

✅ Implementation: Follow secure coding practices (OWASP Top 10).

✅ Testing: Conduct penetration testing, static analysis.

✅ Deployment & Maintenance: Apply security patches regularly.

4. What is the main weakness of the Waterfall Model in security?

✅ Security is considered late in development, making it harder to fix vulnerabilities.

5. Why is the V-Model good for security?

✅ Security verification and validation are done at every phase, making it effective for safety-critical systems.

6. What is DevSecOps?

✅ DevSecOps integrates security practices into the development and operations process to ensure continuous security testing.

7. How does Agile development handle security?

✅ Security must be integrated into each sprint, with automated testing, threat modeling, and security reviews as part of development.

8. What is the difference between Use Cases and Misuse Cases?

✅ Use Case: Describes how a system should function normally.

✅ Misuse Case: Describes how an attacker could exploit vulnerabilities.

9. What is the best way to prevent SQL Injection?

✅ Use prepared statements and input validation to sanitize database queries.

10. What is Multi-Factor Authentication (MFA)?

✅ A security measure that requires multiple forms of verification (e.g., password + fingerprint).

11. What are common software security threats?

✅ SQL Injection – Use input validation & prepared statements.

✅ XSS (Cross-Site Scripting) – Sanitize user inputs & use CSP.

✅ DoS Attack – Implement rate limiting & firewalls.

✅ Phishing – Train users & enforce MFA.

✅ Buffer Overflow – Use safe coding practices.

12. What are the benefits of Security Testing?

✅ Identifies vulnerabilities before attackers do.

✅ Ensures compliance with security policies (e.g., GDPR, HIPAA).

✅ Reduces the cost of fixing security flaws later in development.

13. What is Kanban?

✅ A visual workflow management method that focuses on continuous delivery and work-in-progress limits.

14. How does Kanban compare to Scrum?

15. What are the key security practices in Kanban?

✅ Security Tasks Always Visible – Create a security-focused column.

✅ Continuous Security Testing – Regular penetration testing.

✅ Prioritize Security Fixes – Address high-risk vulnerabilities first.

✅ Security Reviews – Conduct regular audits.

16. What is the biggest lesson from the Equifax Data Breach?

✅ Unpatched vulnerabilities led to 147 million records being leaked, proving the importance of regular software updates.

17. What are some security testing methods?

✅ Static Code Analysis – Scans source code for security flaws.

✅ Penetration Testing – Simulates hacker attacks.

✅ Fuzz Testing – Sends random inputs to check for crashes.

✅ Access Control Testing – Ensures unauthorized users cannot access sensitive data.

18. What is Role-Based Access Control (RBAC)?

✅ A security model where access permissions are assigned based on a user’s role in the organization.

19. Why is Patch Management important?

✅ Patching software regularly fixes known vulnerabilities before attackers exploit them.

20. What is the "Principle of Least Privilege"?

✅ Users and applications should only have access to the minimum necessary data and permissions to perform their tasks.