>> Integrating software applications, part 1.
The learning objectives for this lesson are
to describe secure coding and design patterns,
describe software assurance concepts,
and to differentiate
various software components in integration.
Let's get started. Let's go
over some of the different parts
and components of web technology.
First, we have web servers,
Microsoft Internet Information Server or IIS,
Apache, NGINX and WordPress.
Then we have database software,
Maria DB, postgres SQL,
and Microsoft SQL,
next we have web development frameworks,
Ruby on Rails, Angular, and Django,
then we have markup languages,
XML, CSS, HTML, and JSON,
and finally we have
the actual programming languages, Python,
Ruby, Perl, C-Sharp, Java, JavaScript, and.Net.
Secure coding standards.
Secure coding standards are similar to templates,
and they allow for
a structured approach to creating secure applications.
The goal was to prevent coding vulnerabilities from being
introduced into your actual code.
This also reduces the upfront costs
by preventing the vulnerabilities
rather than having to fix
them after you've released a product.
Here are some sources for secure coding standards.
The first is Carnegie
Mellon Software Engineering Institute,
and the second is OWASP Secure Coding
Practices Quick Reference Guide.
Also don't forget the links are in
the supplemental material for this course.
Here are some examples from OWASP, input validation,
authentication and password management,
session management, database security,
file management, and memory management.
These are areas that programmers need to
take a special care with when they're
creating their applications because this
is where the most common vulnerabilities occur.
These are very common attack vectors
and they're well-known, and because of that,
there have been many vulnerabilities
discovered in many different products across the web.
If you'd like a more detailed explanation
of any of these from the OWASP Top 10,
you can check out Cybrarians Series on OWASP Top 10.
Secure design patterns.
These are a template for a general solution for
a security issue that can be
utilized in different situations.
For example, you may need something that
covers federated identities,
and by using this,
you can ensure that
your federated identity matches up to secured standards.
These can be plug and play,
you drop one in and use that to ensure to
that you're at best practices for
that particular component of your app.
They cover a wide ranging parts
of programming components such
as identity and access management,
federated identities, cryptography,
public facing websites, and many others.
Let's talk about the concerns
we might have with integration.
First, we have container APIs.
These extend the capabilities
of containerized applications.
Then we have API Management.
APIs are often targets from attackers,
and because of that,
we have to take special care
to make sure they're protected
and that they're documented.
We also have Middleware.
These are software applications that are designed
to be integrated between two systems.
When you're looking for a new application,
you go through an application vetting process.
The first step is to do not assume that the software was
created in a secure manner
and is free of vulnerabilities.
Before you implement any software in your organization,
in a production environment,
you have to test it, and testing should validate
all of your security requirements
for the organization before you implement it.
Let's summarize what we went over in this video.
We went over the different types of web technologies.
We discussed secure coding standards
and the application vetting process.
We also whenever secure design patterns
and software used in integrations.
Let's go over some example questions.
Question 1, what is the process of ensuring that
a deployed application meets
security standards for an organization?
Application vetting process. Question 2,
what is the type of software that is
designed to integrate two systems together?
Middleware. Question 3,
blank are templates for
general solutions for
security problems that can be used in
software design, secure design patterns.
Finally, question 4,
these are templates that offer a structured approach to
coding to prevent the introduction
of security vulnerabilities.
Secure coding standards.
I hope that lesson was helpful to
you and I'll see you in the next one.