>> Software development activities.
The learning objectives for this lesson are to
define formal methods of integrating security,
describe testing approaches,
describe continuous delivery methods,
and to evaluate web application security concepts.
Let's get started. This is
the software development life cycle,
it begins with planning.
This is where all the ideas and
requirements are put together
to have a formalized idea of what you want the app to be.
From there, we take it to the solution,
this is where the formal requirements for the app are
taken from everything that
was done in the planning stage.
Then we move to the coding stage where
the requirements are built.
The actual coding will take
place here to develop the product.
Once the product is ready for testing,
we will move to the testing stage.
This is where the app will be put through its paces to
make sure that it lines up with the requirements.
Finally, we move to release,
this is where the product is released to the end-users.
However, the current software development life cycle
has its limitations as far as security is concerned.
Security isn't added into every part of the cycle,
it's usually an afterthought
that is bolted on afterwards.
This is a very dangerous approach for
software development because there
could be fundamental issues with the product from
the very beginning that cannot be
addressed by security on the back end.
In addition to that, our current SDLC
lacks a formal approach to adding
security into the creation of new apps.
Testing approaches, regression testing.
When you're developing software and you make changes,
did any of the changes cause previously
existing functionality or features to fail?
This is what regression testing will let you know.
Next we have unit testing,
this makes sure that a block of code performs
exactly what it was supposed to do.
If it was supposed to perform this function,
then you want to make sure that it only performs
that function and it does it
exactly the way it's supposed to.
Next, we have integration testing,
this is where we take individual
components and then we test
them together to ensure that
they work together as expected.
Development approaches, first,
we have the waterfall model.
The key to remember about this is,
you have to complete
each phase before moving on to the next one.
Because of that waterfall is considered very rigid.
Code checks are performed at the end of
each phase before you can move on to the next.
We start with the requirement phase,
then the design, then implementation,
verification and finally maintenance.
The next development method we will
discuss is the spiral method.
Development has been modified
continually through the process
from stakeholder feedback a product is released,
receives feedback, it is
modified and that's a continual cycle.
Risk analysis performed at each interactive step.
It's well suited for large complex projects.
Next we have the Agile model.
This uses iterative processes
to release well-tested code in smaller blocks.
Development is considered to be continuous,
it is adaptive to allow for changes throughout
the process and it focuses on rapid deployment,
often at the expense of security.
The thing to keep in mind about Agile is they
want it fast and it's always moving.
It's not rigid like the waterfall method is.
SecDevOps, there are
two main requirements for SecDevOps.
The first is security as code,
this uses automated methods for
static code testing and dynamic application testing.
We also have infrastructure as code,
uses configuration management tools
to control code changes.
Examples of this would be Puppet and Ansible.
You want to consider requiring security to be
included in all decisions plans and coding.
It requires developers to have strong understanding of
possible vulnerabilities and must
use version control for code changes.
Following this process ensures that you
develop secure code from
the outset all the way through to deployment.
This is a much more time-consuming process
and also requires
deeper understanding of what you're trying
to do and how that works with security.
Instructor side note.
You might want to look at Ansible for your own network,
it's not just useful for code
and for code management, that type of thing.
It will also allow you to rapidly deploy
configurations or keep devices at a specific baseline.
Ansible makes use of playbooks,
and these can be deployed for
configuration management and updates.
For example, if you're deploying many Linux servers,
you can use an Ansible playbook that will automatically
configure that server to
the standard or the baseline that you're looking for.
It will ensure that it has
the specific apps that you're looking for installed,
configuration changes, that type of
thing done automatically for you.
I use Ansible to keep all of
our devices up-to-date and current,
and also to make sure that
they stay at a certain baseline,
that things aren't deviating from that.
Continuous delivery methods.
First we have is continuous integration
DevOps should commit and test updates often.
Next we have continuous delivery.
Testing the infrastructure that supports the app,
networks, databases, client software insecurity.
Next is continuous deployment.
This utilizes configuration management tools to
make changes to the production environment.
Finally, we have continuous validation.
Feedback from delivery and development
is monitored and evaluated to ensure
goals are meeting user
needs this also must stay with secure config baselines.
Web Application Security Concepts.
OWASP, or the Open Web Application Security Project is
something you really need to get to know if
you're developing web applications.
They are a non-profit online community that
creates an publishes guides for secure app creation.
The next thing you want to consider is
HTTP headers these are
security options they can be set in headers,
returned by a web server to a client.
There are quite a few of them,
but some of the examples are
HTTP Strict Security Transport,
DSTS, X- Frame Options,
XFO, X-Content-Type-Options and others.
OWASP also has their own secure headers project,
these are recommendations for
HTTP response headers for increased security.
You can get all their information at the OWASP website.
Also keep in mind that Cybrary has
their own course on the OWASP Top
10 and these are
the most common vulnerabilities for web applications.
Summary, we went
over integrating security into development,
we also discussed software testing approaches.
We went over continuous delivery methods
and then Web Application Security concepts.
Let's do some example questions. Question 1.
Which development model uses
interactive processes to really smaller blocks
of code that had been well-tested?
This is the Agile model.
Question 2. What organization
publishes a top 10 list of
the most critical application security risks?
OWASP. Question 3.
Which stage of the software
development life-cycle is responsible
for gathering all of
the necessary information on
how an application should function?
Planning and requirements gathering.
Finally question 4.
Which type of testing seeks to find if any changes in
code have caused previously existing functions
or features to fail?
Regression testing. I hope
this lesson was useful for
you, and I'll see you in the next one.