>> Integrating software applications, Part 2.
The learning objectives for this lesson are
to describe software assurance concepts,
to define software testing approaches,
and to evaluate integration services.
Let's get started. The first software assurance concept
we're going to discuss is sandboxing.
Sandboxing allows for you to test
your applications away from your production environment.
This way if there are any issues
with the app that you're creating,
it doesn't spill over and
cause issues in your production environment.
Your sandbox can be created to match
as little or as much of
your production environment as necessary.
For example, if you just need
an end-user workstation environment,
that can be added to your sandbox.
But perhaps you're developing something that
requires servers and end-users
interacting with that server,
you can then add all of that to a sandbox environment.
Each process is completely separated from each other,
and this makes sure that each part of
the development process doesn't
cause changes in the others.
Development environments. First,
we start with development.
This is where the app is created and the code is written.
Then it moves to test and integration.
This is where we make sure that everything
works the way it's supposed to,
and are there any unforeseen issues that
maybe we didn't notice in the development process?
Then we move to staging or quality assurance.
After that, we move to production.
Third-party library validation.
In modular programming today,
it's very easy to use library supplied
by other software vendors or individuals.
However, before we integrate
these libraries into our own apps,
we have to validate that they don't bring
in their own security vulnerabilities.
In fact, third-party libraries
themselves may also have third-party libraries.
Oftentimes, these libraries aren't maintained,
and by doing this it introduces
security vulnerabilities into our application.
Before allowing
any third-party library into an application,
it has to be thoroughly vetted and
ensured not to have any security vulnerabilities.
The DevOps pipeline.
Regardless of how an organization programs
or creates its own applications,
it follows this basic guide.
It's more of an assembly line type situation
where it starts with planning,
moves to coding, then to build,
then to test. That's the dev side.
After that,it moves over to ops with the release,
the deploy, the operate, and the monitor,
and then it starts itself over again with
planning because of new issues,
new features, new things
that need to be integrated into the app.
Code signing. This is using
a certificate to establish
proof of where the code came from.
When you download updates from Microsoft,
each of those updates is
signed with Microsoft's certificate.
This is a very important part of software development.
It does not guarantee that the app works correctly,
it only guarantees that it
is from the source it claims to be from.
However, attackers have learned
how to forge code signing.
An example of this was Stuxnet.
It used forged digital certificates
to bypass malware detection software.
Parts of the payload were signed with certificates
from semiconductor manufacturing companies.
Because of that, they were allowed in and did
not get picked up because they were
signed and thought to be authentic.
Application security testing.
The first style is static
application security testing or SAST.
This is when we review the code when it isn't running.
The next is dynamic application security testing.
This is reviewing code while it is
running and used as a final product.
The final one is interactive application security testing
which analyzes the code while it's
running for security issues.
Also, it looks for problems
when different functions of the app are triggered.
Enterprise application integration.
First, we're going to discuss customer
relationship management software or CRM.
This contains customer information, sales,
communication, and many other sensitive items.
Companies use this to manage
how they interact with their own customers.
A good example of this would be Salesforce.
The next would be enterprise resource planning or ERP.
This monitors the day-to-day operations
of an enterprise and it can provide
reports on the resources and
activities inside the enterprise itself.
Configuration management database, CMDB.
This contains the information on the assets and
components of an enterprise's IT infrastructure.
Finally, we have content management system or CMS.
This enables non-technical users to
create and publish content to a website.
Good examples of these are WordPress and SharePoint.
Configuration management database.
This database contains all of
the information about an enterprise's IT assets.
It could be how your email
client configurations are stored.
Different dashboards can be created to
show how this data is viewed.
We also have individual system configuration
stored applications,
databases, telephony configurations, desktop information.
The purpose of this is to ensure that we
have one place to go to look for
all of our configurations and
details about all of our IT assets.
Integration services.
While we're developing applications,
we sometimes have to integrate with other services.
The first is directory services.
Active directory is a good example of this,
it contains all the information about users and objects,
and devices on a network.
Sometimes we need to be able to connect to
this for authentication purposes.
The next, we have Domain Name System or DNS.
This is where we change a domain name into an IP address.
Applications often need to be able to
go online or utilize
resources on our internal network by
a DNS name rather than an IP address.
Service-oriented architecture or SOA.
This is a method of designing apps in
a form of interoperable services.
The purpose of this is to create
individual apps that perform individual services,
then those apps can be connected together to perform
services together and
thereby creating additional services.
This allows for a modular approach
for creating an application.
Then finally, we have enterprise service bus or ESB.
These are the middleware apps that integrate
the communications for SOA apps in an enterprise.
Summary. In this video,
we discussed the methods
of software security integration.
We also discussed software testing approaches.
Finally, we discussed
software integration services and
integrating enterprise applications.
Let's go over some review questions.
Which testing process reviews
the application code while it isn't running?
Static application security testing or SAST. Question 2.
Blank monitors the day-to-day operations
and reports on the status of resources in an enterprise.
Enterprise resource planning or ERP. Question 3.
What describes how each type of environment is
separated from each other during application development?
Sandboxing. Finally, in question 4.
A software application has been tested
and is ready for customers to start using it.
What stage of the DevOps pipeline
is the application in now?
Release. I hope this lesson
was helpful for you, and I'll see you in the next one.