1 1 00:00:00,360 --> 00:00:03,420 Software Development Life Cycle. 2 2 00:00:03,420 --> 00:00:04,920 In this lesson, we are going to talk 3 3 00:00:04,920 --> 00:00:06,780 about the software development lifecycle 4 4 00:00:06,780 --> 00:00:09,030 and how important it is to start embedding 5 5 00:00:09,030 --> 00:00:11,520 your security in from the beginning. 6 6 00:00:11,520 --> 00:00:13,950 Now when I talk about the Software Development Life Cycle 7 7 00:00:13,950 --> 00:00:17,010 or SDLC, this is talking about the process 8 8 00:00:17,010 --> 00:00:20,490 of planning, analysis, design, implementation 9 9 00:00:20,490 --> 00:00:22,560 and maintenance that governs software 10 10 00:00:22,560 --> 00:00:24,390 and systems development. 11 11 00:00:24,390 --> 00:00:27,030 Now as you start building your software, it is important 12 12 00:00:27,030 --> 00:00:29,640 to think about security all the way from the beginning. 13 13 00:00:29,640 --> 00:00:31,710 And if you make sure that you integrate security controls 14 14 00:00:31,710 --> 00:00:34,140 into each stage of the SDLC, 15 15 00:00:34,140 --> 00:00:36,810 it will save you a lot of time and money. 16 16 00:00:36,810 --> 00:00:39,690 Now, there's really two ways to do software development. 17 17 00:00:39,690 --> 00:00:42,330 We have the more traditional method known as Waterfall 18 18 00:00:42,330 --> 00:00:44,850 and then the newer method known as Agile. 19 19 00:00:44,850 --> 00:00:46,923 In this lesson, we're going to talk about both of these. 20 20 00:00:46,923 --> 00:00:48,750 Now when we start out we want to talk 21 21 00:00:48,750 --> 00:00:51,180 about the traditional method, which is Waterfall. 22 22 00:00:51,180 --> 00:00:53,970 The Waterfall method is a software development model 23 23 00:00:53,970 --> 00:00:57,180 where the phases of the SDLC cascade downward 24 24 00:00:57,180 --> 00:00:58,920 so that each phase will start only 25 25 00:00:58,920 --> 00:01:00,720 when all of the tasks identified 26 26 00:01:00,720 --> 00:01:03,300 in the previous phase were already completed. 27 27 00:01:03,300 --> 00:01:05,940 This means we're going to do all of the planning then all 28 28 00:01:05,940 --> 00:01:08,240 of the requirements, then all of the design, then all 29 29 00:01:08,240 --> 00:01:10,770 of the implementation, then all of the verification. 30 30 00:01:10,770 --> 00:01:12,900 And then all of the testing and all of the maintenance 31 31 00:01:12,900 --> 00:01:14,760 and eventually all of the retirement. 32 32 00:01:14,760 --> 00:01:17,490 And that's one version of one piece of software. 33 33 00:01:17,490 --> 00:01:19,554 And so all these things cascade downward 34 34 00:01:19,554 --> 00:01:21,870 as we go through this life cycle. 35 35 00:01:21,870 --> 00:01:23,520 Now when you're dealing with Waterfall, 36 36 00:01:23,520 --> 00:01:25,050 there are a lot of benefits to it. 37 37 00:01:25,050 --> 00:01:26,640 This is the way people have been doing software 38 38 00:01:26,640 --> 00:01:28,560 and projects for decades. 39 39 00:01:28,560 --> 00:01:30,383 Now the big problem we have with it is 40 40 00:01:30,383 --> 00:01:32,580 that when you have an idea for something. 41 41 00:01:32,580 --> 00:01:34,710 And you start creating the plan and the requirements 42 42 00:01:34,710 --> 00:01:36,540 and then go all the way through the stage, 43 43 00:01:36,540 --> 00:01:38,040 this can take a long time. 44 44 00:01:38,040 --> 00:01:40,463 Anywhere from 6 months, 12 months, 45 45 00:01:40,463 --> 00:01:42,720 sometimes two or three years. 46 46 00:01:42,720 --> 00:01:44,640 And so if I wanted to develop a brand new piece 47 47 00:01:44,640 --> 00:01:47,010 of software and I'm going to put all this money into it. 48 48 00:01:47,010 --> 00:01:49,770 And do all this development and then not see anything out 49 49 00:01:49,770 --> 00:01:52,020 the other side to deliver to my customer until two 50 50 00:01:52,020 --> 00:01:55,200 or three years, that's a really long development cycle. 51 51 00:01:55,200 --> 00:01:56,670 And if when I get it to my customer, 52 52 00:01:56,670 --> 00:01:58,200 they find something wrong with it 53 53 00:01:58,200 --> 00:02:00,090 I now have to go back to the beginning 54 54 00:02:00,090 --> 00:02:02,340 and start going all the way through that cycle again. 55 55 00:02:02,340 --> 00:02:04,650 And so this is something that gives a lot of delays. 56 56 00:02:04,650 --> 00:02:07,401 And so if you don't do a lot of your security upfront 57 57 00:02:07,401 --> 00:02:09,750 in your design and implementing it all the way 58 58 00:02:09,750 --> 00:02:10,740 through these phases. 59 59 00:02:10,740 --> 00:02:12,988 And you try to bolt on security as an afterthought, 60 60 00:02:12,988 --> 00:02:14,550 it's going to take a long time 61 61 00:02:14,550 --> 00:02:16,950 and you're going to have an insecure piece of software. 62 62 00:02:16,950 --> 00:02:18,540 Now, the other way we can do things is 63 63 00:02:18,540 --> 00:02:20,010 what's known as Agile. 64 64 00:02:20,010 --> 00:02:22,500 The Agile method is a software development model 65 65 00:02:22,500 --> 00:02:23,910 that focuses on iterative 66 66 00:02:23,910 --> 00:02:25,770 and incremental development to account 67 67 00:02:25,770 --> 00:02:28,098 for evolving requirements and expectations. 68 68 00:02:28,098 --> 00:02:30,750 Now the nice thing about Agile is that they work 69 69 00:02:30,750 --> 00:02:32,706 pretty quickly when you're trying to develop something. 70 70 00:02:32,706 --> 00:02:35,460 I can have an idea for something and have something out 71 71 00:02:35,460 --> 00:02:37,579 in the market within two weeks or four weeks. 72 72 00:02:37,579 --> 00:02:39,390 Now it's not going to be perfect, 73 73 00:02:39,390 --> 00:02:42,240 it's not going to be the complete program but it's something. 74 74 00:02:42,240 --> 00:02:43,650 The whole idea with Agile is getting 75 75 00:02:43,650 --> 00:02:45,330 something into the hands of your consumer 76 76 00:02:45,330 --> 00:02:47,190 and getting it out there quickly. 77 77 00:02:47,190 --> 00:02:49,650 So most of the software development you see today done 78 78 00:02:49,650 --> 00:02:52,140 by startups is done in an Agile way. 79 79 00:02:52,140 --> 00:02:53,640 They're going to go forward and they're going to think 80 80 00:02:53,640 --> 00:02:55,410 of some concept, they're going to have some kind 81 81 00:02:55,410 --> 00:02:57,810 of idea for it, they're going to start the design. 82 82 00:02:57,810 --> 00:02:58,800 They're going to start planning 83 83 00:02:58,800 --> 00:02:59,730 and they're going to start building. 84 84 00:02:59,730 --> 00:03:01,435 And they're going to start testing 85 85 00:03:01,435 --> 00:03:02,760 and they're going to do this all over 86 86 00:03:02,760 --> 00:03:04,020 and over and over again in these quick loops. 87 87 00:03:04,020 --> 00:03:05,610 And then they get something that's ready 88 88 00:03:05,610 --> 00:03:07,800 and they push out the door into production. 89 89 00:03:07,800 --> 00:03:10,170 And so we can go from idea to execution 90 90 00:03:10,170 --> 00:03:13,260 in maybe a week or two weeks or maybe four weeks. 91 91 00:03:13,260 --> 00:03:15,120 And we do these in these short sprints 92 92 00:03:15,120 --> 00:03:16,740 to be able to get things out. 93 93 00:03:16,740 --> 00:03:17,940 The whole idea when you're dealing 94 94 00:03:17,940 --> 00:03:19,530 with Agile is getting that product 95 95 00:03:19,530 --> 00:03:21,300 into the hands of the consumer. 96 96 00:03:21,300 --> 00:03:23,700 And so let's use an example of this course. 97 97 00:03:23,700 --> 00:03:25,470 I could do it as a Waterfall method 98 98 00:03:25,470 --> 00:03:27,480 or I could do it as an Agile method. 99 99 00:03:27,480 --> 00:03:30,240 If I was going to do it in a Waterfall method, I would go out 100 100 00:03:30,240 --> 00:03:31,710 and outline every single video 101 101 00:03:31,710 --> 00:03:32,543 that's going to be in this course. 102 102 00:03:32,543 --> 00:03:34,920 So I say, okay, here are going to be 38 sections 103 103 00:03:34,920 --> 00:03:36,930 and in section one I'm going to have these videos. 104 104 00:03:36,930 --> 00:03:38,991 And in section two, I'm going to have these videos. 105 105 00:03:38,991 --> 00:03:41,310 I'm going to have these lessons here and these quizzes here 106 106 00:03:41,310 --> 00:03:42,690 and these practice exams here. 107 107 00:03:42,690 --> 00:03:44,880 And I figure out all the things I want. 108 108 00:03:44,880 --> 00:03:46,620 And then once we've all agreed to it 109 109 00:03:46,620 --> 00:03:48,060 that becomes set in stone. 110 110 00:03:48,060 --> 00:03:49,290 That's what we're going to do. 111 111 00:03:49,290 --> 00:03:51,180 Then we start writing the lessons and filming 112 112 00:03:51,180 --> 00:03:52,860 the lessons and building the quizzes. 113 113 00:03:52,860 --> 00:03:54,750 And once we get all of those together 114 114 00:03:54,750 --> 00:03:57,120 we take all of that, we bundle it up, we package it up 115 115 00:03:57,120 --> 00:03:58,500 and we sell it to our customers. 116 116 00:03:58,500 --> 00:03:59,580 Agile method. 117 117 00:03:59,580 --> 00:04:01,440 This is the way traditional book authors work 118 118 00:04:01,440 --> 00:04:02,550 because when you print a book 119 119 00:04:02,550 --> 00:04:04,412 you can't go back and add more pages later. 120 120 00:04:04,412 --> 00:04:06,300 But because this course is digital 121 121 00:04:06,300 --> 00:04:08,520 I don't have to do it in that Waterfall method. 122 122 00:04:08,520 --> 00:04:11,340 Instead, I might do it in a more Agile way. 123 123 00:04:11,340 --> 00:04:13,500 Maybe I would say this, hey customers, 124 124 00:04:13,500 --> 00:04:14,730 I'm going to make a brand new course. 125 125 00:04:14,730 --> 00:04:16,440 It's on CySA+. 126 126 00:04:16,440 --> 00:04:18,630 If you want to get into it, you're going to pay up front. 127 127 00:04:18,630 --> 00:04:20,940 And every week I'm going to give you some more content. 128 128 00:04:20,940 --> 00:04:24,060 And so what can happen is you sign up for the course today 129 129 00:04:24,060 --> 00:04:25,350 and this week you're already getting 130 130 00:04:25,350 --> 00:04:26,910 the first two hours of the course. 131 131 00:04:26,910 --> 00:04:28,890 Next week you get another two hours of the course. 132 132 00:04:28,890 --> 00:04:30,780 The next week you get another two hours of the course 133 133 00:04:30,780 --> 00:04:32,130 and we'll keep doing that until you get 134 134 00:04:32,130 --> 00:04:33,810 the entire course that you needed. 135 135 00:04:33,810 --> 00:04:35,040 That'd be more Agile way for me 136 136 00:04:35,040 --> 00:04:37,020 to deliver this kind of material. 137 137 00:04:37,020 --> 00:04:38,670 Now either way you can do this 138 138 00:04:38,670 --> 00:04:41,160 and both of them are acceptable ways of doing things. 139 139 00:04:41,160 --> 00:04:43,440 But it depends on what is going to be best 140 140 00:04:43,440 --> 00:04:45,930 for your customers and for your consumers. 141 141 00:04:45,930 --> 00:04:48,180 Now in the digital world when we're dealing with products 142 142 00:04:48,180 --> 00:04:50,880 and software, it works a lot better to do things Agilely. 143 143 00:04:50,880 --> 00:04:53,100 Because if I start giving you this course 144 144 00:04:53,100 --> 00:04:54,847 and the first week I get feedback from you, it says, 145 145 00:04:54,847 --> 00:04:57,000 "Hey, I don't like the way you do these videos." 146 146 00:04:57,000 --> 00:04:58,560 I can actually change that 147 147 00:04:58,560 --> 00:05:01,290 and I can edit it before I go into the next section. 148 148 00:05:01,290 --> 00:05:03,600 And so we get more feedback, more iterations 149 149 00:05:03,600 --> 00:05:06,270 and any bugs we find can be fixed even quicker. 150 150 00:05:06,270 --> 00:05:08,100 Instead of waiting for us to do six full months 151 151 00:05:08,100 --> 00:05:10,200 of development of writing and filming this thing, 152 152 00:05:10,200 --> 00:05:12,330 And then giving it to you and then finding there's errors 153 153 00:05:12,330 --> 00:05:14,640 'cause then we have to go back and start all over again. 154 154 00:05:14,640 --> 00:05:15,750 That's one of the big differences 155 155 00:05:15,750 --> 00:05:17,910 between Waterfall and Agile. 156 156 00:05:17,910 --> 00:05:20,460 Now as I said your security has to be integrated 157 157 00:05:20,460 --> 00:05:22,470 into your Software Development Life Cycle. 158 158 00:05:22,470 --> 00:05:24,720 And there's a couple of different ways you can do this. 159 159 00:05:24,720 --> 00:05:26,730 One of the most common ways this is done is 160 160 00:05:26,730 --> 00:05:28,680 by using security targeted frameworks. 161 161 00:05:28,680 --> 00:05:30,780 They can incorporate threat and vulnerability 162 162 00:05:30,780 --> 00:05:32,370 and risk related controls 163 163 00:05:32,370 --> 00:05:34,470 into the software development lifecycle. 164 164 00:05:34,470 --> 00:05:36,540 So as we're thinking about the requirements 165 165 00:05:36,540 --> 00:05:39,180 and the plans and the designs and the implementation, 166 166 00:05:39,180 --> 00:05:41,820 we want to integrate the security all the way through. 167 167 00:05:41,820 --> 00:05:43,900 And so security target frameworks can help us with that. 168 168 00:05:43,900 --> 00:05:46,470 Now in your textbook they mentioned two types 169 169 00:05:46,470 --> 00:05:48,300 of security targeted frameworks. 170 170 00:05:48,300 --> 00:05:51,983 The first is SDL, which is a security development lifecycle. 171 171 00:05:51,983 --> 00:05:54,900 Now SDL is Microsoft's security framework 172 172 00:05:54,900 --> 00:05:56,160 for application development 173 173 00:05:56,160 --> 00:05:58,650 that supports dynamic development processes. 174 174 00:05:58,650 --> 00:06:00,600 And so they work in an Agile way 175 175 00:06:00,600 --> 00:06:02,760 and this is a way to implement security 176 176 00:06:02,760 --> 00:06:04,710 throughout that Agile process. 177 177 00:06:04,710 --> 00:06:07,170 Now another good one that's out there is OWASP. 178 178 00:06:07,170 --> 00:06:10,440 Now OWASP is the Open Web Application Security Project 179 179 00:06:10,440 --> 00:06:13,440 and they have their software security assurance process. 180 180 00:06:13,440 --> 00:06:14,880 This is their security framework 181 181 00:06:14,880 --> 00:06:16,677 for secure application development. 182 182 00:06:16,677 --> 00:06:18,240 Now if you're not familiar with OWASP, 183 183 00:06:18,240 --> 00:06:20,940 you can go to owasp.org. 184 184 00:06:20,940 --> 00:06:23,640 And this is a website that is a community-funded website 185 185 00:06:23,640 --> 00:06:25,200 and community-built website. 186 186 00:06:25,200 --> 00:06:27,340 They are all about making sure that the best information 187 187 00:06:27,340 --> 00:06:30,510 about coding practices is out there for the community. 188 188 00:06:30,510 --> 00:06:31,950 So as a cybersecurity analyst, 189 189 00:06:31,950 --> 00:06:33,780 I do recommend you take some time looking 190 190 00:06:33,780 --> 00:06:36,180 at OWASP and looking through their various top 10 lists. 191 191 00:06:36,180 --> 00:06:38,490 There's a lot of good information there. 192 192 00:06:38,490 --> 00:06:39,510 Now as we go forward 193 193 00:06:39,510 --> 00:06:41,130 and we start thinking about secure development, 194 194 00:06:41,130 --> 00:06:42,840 I mentioned that we have to start integrating it 195 195 00:06:42,840 --> 00:06:44,580 into each of these phases. 196 196 00:06:44,580 --> 00:06:46,830 For example in the planning phase, we need to make sure 197 197 00:06:46,830 --> 00:06:48,840 we're training our developers and our testers 198 198 00:06:48,840 --> 00:06:50,820 on the different security issues that are out there. 199 199 00:06:50,820 --> 00:06:52,740 If I start incorporating that into their training 200 200 00:06:52,740 --> 00:06:54,990 so they understand what a buffer overflow attack is, 201 201 00:06:54,990 --> 00:06:57,840 why input validation is important and things like that, 202 202 00:06:57,840 --> 00:07:00,750 they can think about that as they build their software. 203 203 00:07:00,750 --> 00:07:02,319 Then we need to think about requirements. 204 204 00:07:02,319 --> 00:07:03,630 When we're dealing with requirements, 205 205 00:07:03,630 --> 00:07:06,330 we have to determine the needs for security and privacy. 206 206 00:07:06,330 --> 00:07:08,220 If I'm building an application that's going to be open 207 207 00:07:08,220 --> 00:07:10,200 to the internet, do I need a password? 208 208 00:07:10,200 --> 00:07:11,790 Well, maybe or maybe not. 209 209 00:07:11,790 --> 00:07:13,593 If that application is to display my website 210 210 00:07:13,593 --> 00:07:15,330 I probably don't need a password 211 211 00:07:15,330 --> 00:07:17,520 'cause you just need to go to my website and read it. 212 212 00:07:17,520 --> 00:07:19,710 But if there's a secure area of my website 213 213 00:07:19,710 --> 00:07:21,900 then I need to have that security put in place. 214 214 00:07:21,900 --> 00:07:23,430 So you have to give me a user and password 215 215 00:07:23,430 --> 00:07:25,440 to access that part of the site. 216 216 00:07:25,440 --> 00:07:27,390 The next stage we have to think about is design. 217 217 00:07:27,390 --> 00:07:29,430 And with design we have to identify the different threats 218 218 00:07:29,430 --> 00:07:32,130 and controls that we're going to use when we design 219 219 00:07:32,130 --> 00:07:33,900 and start coding this software. 220 220 00:07:33,900 --> 00:07:35,340 Then this brings us to our next stage, 221 221 00:07:35,340 --> 00:07:36,900 which is implementation. 222 222 00:07:36,900 --> 00:07:38,220 When we're doing implementation, 223 223 00:07:38,220 --> 00:07:40,590 we want to make sure we're doing source code analysis 224 224 00:07:40,590 --> 00:07:43,650 so we understand what's being written and how it works. 225 225 00:07:43,650 --> 00:07:45,180 Then we're going to go into testing 226 226 00:07:45,180 --> 00:07:46,710 and here's where we want to start performing 227 227 00:07:46,710 --> 00:07:49,380 a known environment or partially known environment testing. 228 228 00:07:49,380 --> 00:07:51,660 And start testing the system for vulnerabilities 229 229 00:07:51,660 --> 00:07:53,790 to see if people can break our software. 230 230 00:07:53,790 --> 00:07:55,530 Because if they can break into our software 231 231 00:07:55,530 --> 00:07:58,257 that means we need to fix that and go back into design 232 232 00:07:58,257 --> 00:08:01,320 and implementation to fix those coding errors. 233 233 00:08:01,320 --> 00:08:02,640 And then we have deployment. 234 234 00:08:02,640 --> 00:08:03,990 This is where we're going to take the software 235 235 00:08:03,990 --> 00:08:06,000 and we're going to put it out into the environment. 236 236 00:08:06,000 --> 00:08:07,890 We're going to install it on a server, we're going to install it 237 237 00:08:07,890 --> 00:08:10,860 on a client and we're going to make sure it works properly. 238 238 00:08:10,860 --> 00:08:12,240 Now here's where we're going to be focused 239 239 00:08:12,240 --> 00:08:14,850 on the installer packages and the different best practices 240 240 00:08:14,850 --> 00:08:16,290 of how you should configure it. 241 241 00:08:16,290 --> 00:08:18,270 And then finally, we have maintenance. 242 242 00:08:18,270 --> 00:08:21,150 We have to have ongoing security monitoring and maintenance. 243 243 00:08:21,150 --> 00:08:22,620 So we put out this software. 244 244 00:08:22,620 --> 00:08:24,000 We think it's the best thing ever 245 245 00:08:24,000 --> 00:08:25,999 but then there's a vulnerability that's found. 246 246 00:08:25,999 --> 00:08:27,030 What does that mean? 247 247 00:08:27,030 --> 00:08:28,050 Well, we have to do maintenance. 248 248 00:08:28,050 --> 00:08:29,790 Somebody has to code a patch. 249 249 00:08:29,790 --> 00:08:30,930 We need to test that patch. 250 250 00:08:30,930 --> 00:08:32,220 We need to deploy that patch 251 251 00:08:32,220 --> 00:08:34,770 and then maintain the ongoing operations again. 252 252 00:08:34,770 --> 00:08:35,700 This is how we can make sure 253 253 00:08:35,700 --> 00:08:37,980 our security controls are all in place. 254 254 00:08:37,980 --> 00:08:40,320 Now I mentioned testing and when we talk about testing 255 255 00:08:40,320 --> 00:08:41,490 I want you to think about the fact 256 256 00:08:41,490 --> 00:08:43,530 that there are three types of testing. 257 257 00:08:43,530 --> 00:08:45,600 We have unknown environment testing, 258 258 00:08:45,600 --> 00:08:46,830 known environment testing 259 259 00:08:46,830 --> 00:08:48,870 and partially known environment testing. 260 260 00:08:48,870 --> 00:08:50,640 Now I talk about unknown environment testing. 261 261 00:08:50,640 --> 00:08:52,860 This is also known as blind testing. 262 262 00:08:52,860 --> 00:08:54,780 This is when a cybersecurity analyst receives 263 263 00:08:54,780 --> 00:08:57,480 no privileged information about the software. 264 264 00:08:57,480 --> 00:09:01,017 So if I give you a binary from say Microsoft Windows 265 265 00:09:01,017 --> 00:09:02,761 and I say, go ahead and test this, 266 266 00:09:02,761 --> 00:09:05,010 that is unknown environment testing. 267 267 00:09:05,010 --> 00:09:06,270 You don't have the source code, 268 268 00:09:06,270 --> 00:09:07,380 you don't have any permissions. 269 269 00:09:07,380 --> 00:09:08,580 You don't know anything about it. 270 270 00:09:08,580 --> 00:09:11,070 You just know this is a binary and you need to test it. 271 271 00:09:11,070 --> 00:09:12,210 And so you can run different tests 272 272 00:09:12,210 --> 00:09:14,220 against it and see what you can find. 273 273 00:09:14,220 --> 00:09:15,960 Now on the other hand, if I was writing my own code 274 274 00:09:15,960 --> 00:09:18,300 I might have you do known environment testing. 275 275 00:09:18,300 --> 00:09:19,620 If I'm doing known environment testing, 276 276 00:09:19,620 --> 00:09:21,990 this is also known as full disclosure testing. 277 277 00:09:21,990 --> 00:09:23,880 This is where a cybersecurity analyst receives 278 278 00:09:23,880 --> 00:09:26,100 privileged information about the software. 279 279 00:09:26,100 --> 00:09:26,940 So you might get things 280 280 00:09:26,940 --> 00:09:28,890 like the source code and credentials. 281 281 00:09:28,890 --> 00:09:30,540 So I could say, "Hey, I built this new app 282 282 00:09:30,540 --> 00:09:32,190 for my website to test my students. 283 283 00:09:32,190 --> 00:09:33,450 Can you go ahead and test it?" 284 284 00:09:33,450 --> 00:09:36,000 Here's the source code and you can look at it line by line 285 285 00:09:36,000 --> 00:09:37,530 and know exactly what it's doing. 286 286 00:09:37,530 --> 00:09:40,140 And then you can put it through dynamic testing as well. 287 287 00:09:40,140 --> 00:09:41,490 Now the other kind we have is what's known 288 288 00:09:41,490 --> 00:09:43,230 as partially known environment testing. 289 289 00:09:43,230 --> 00:09:45,360 And this is kind of a in between place. 290 290 00:09:45,360 --> 00:09:47,280 This is where a cybersecurity analyst is going to receive 291 291 00:09:47,280 --> 00:09:50,430 partial disclosure of information about the software. 292 292 00:09:50,430 --> 00:09:52,890 I may not give you the entire source code 293 293 00:09:52,890 --> 00:09:54,750 but I might give you some information and say, 294 294 00:09:54,750 --> 00:09:56,400 this is what the thing is supposed to do. 295 295 00:09:56,400 --> 00:09:57,630 Here's the inputs it takes, 296 296 00:09:57,630 --> 00:09:59,490 here's the outputs you should expect. 297 297 00:09:59,490 --> 00:10:01,080 Here is a standard user account 298 298 00:10:01,080 --> 00:10:03,120 that you can use going against this software 299 299 00:10:03,120 --> 00:10:04,800 and then you can do your testing with that. 300 300 00:10:04,800 --> 00:10:08,190 It's not fully blind but it's not fully disclosed. 301 301 00:10:08,190 --> 00:10:09,023 So that's why we call it 302 302 00:10:09,023 --> 00:10:10,620 partially known environment testing. 303 303 00:10:10,620 --> 00:10:12,540 It's between the unknown and known testing. 304 304 00:10:12,540 --> 00:10:14,984 Next, let's talk about some secure coding best practices 305 305 00:10:14,984 --> 00:10:18,360 because secure coding can make your software more secure. 306 306 00:10:18,360 --> 00:10:21,060 And save your organization even more money. 307 307 00:10:21,060 --> 00:10:23,490 Because when you're putting on security as an afterthought, 308 308 00:10:23,490 --> 00:10:25,410 it's actually much more expensive 309 309 00:10:25,410 --> 00:10:26,520 than building your programs 310 310 00:10:26,520 --> 00:10:28,650 with security from the beginning. 311 311 00:10:28,650 --> 00:10:30,030 Now to do this, you want to make sure 312 312 00:10:30,030 --> 00:10:31,440 you're using secure coding. 313 313 00:10:31,440 --> 00:10:33,630 And there's some best practices you should be aware of. 314 314 00:10:33,630 --> 00:10:36,000 So when it comes to secure coding best practices, 315 315 00:10:36,000 --> 00:10:38,580 there's really two organizations that I like to think of. 316 316 00:10:38,580 --> 00:10:42,245 The first is OWASP and the second is SANS. 317 317 00:10:42,245 --> 00:10:45,540 When we talk about O-W-A-S-P or OWASP, 318 318 00:10:45,540 --> 00:10:48,330 this is the open web application security project. 319 319 00:10:48,330 --> 00:10:50,850 And it's a charity and community that publishes 320 320 00:10:50,850 --> 00:10:53,328 a number of secure application development resources. 321 321 00:10:53,328 --> 00:10:54,870 When we talk about SANS, 322 322 00:10:54,870 --> 00:10:58,230 this is a System Admin, Network and Security Institute. 323 323 00:10:58,230 --> 00:11:00,660 This is a company that specializes in cybersecurity 324 324 00:11:00,660 --> 00:11:02,850 and secure web application development training. 325 325 00:11:02,850 --> 00:11:05,430 And it also sponsors the GIAC certification, 326 326 00:11:05,430 --> 00:11:07,632 the Global Information Assurance Certification. 327 327 00:11:07,632 --> 00:11:10,680 Now for the exam, let me give you a quick tip. 328 328 00:11:10,680 --> 00:11:15,680 It is worth your time to go to owasp.org, OWASP website. 329 329 00:11:15,810 --> 00:11:16,680 And I want you to go there 330 330 00:11:16,680 --> 00:11:18,870 and look at their various top 10 lists. 331 331 00:11:18,870 --> 00:11:20,910 When you go through those, you're going to see a lot 332 332 00:11:20,910 --> 00:11:22,350 of things that we cover in this course. 333 333 00:11:22,350 --> 00:11:24,270 They're going to talk about SQL injections 334 334 00:11:24,270 --> 00:11:26,790 and XML injections and buffer overflows 335 335 00:11:26,790 --> 00:11:29,220 and race conditions and all of those type of things. 336 336 00:11:29,220 --> 00:11:30,930 And for each of those they're going to have articles 337 337 00:11:30,930 --> 00:11:32,400 that gives you examples of them, 338 338 00:11:32,400 --> 00:11:35,580 including in detail for the source code. 339 339 00:11:35,580 --> 00:11:37,500 Now CompTIA loves the poll questions 340 340 00:11:37,500 --> 00:11:41,580 for the CYSA+ and the PenTest+ exams from OWASP. 341 341 00:11:41,580 --> 00:11:43,950 Why, because it is a great resource 342 342 00:11:43,950 --> 00:11:46,410 and it is the most common 10 vulnerabilities 343 343 00:11:46,410 --> 00:11:48,720 that you'll find for any particular topic. 344 344 00:11:48,720 --> 00:11:51,030 So do spend some time looking through those. 345 345 00:11:51,030 --> 00:11:54,090 When I write my practice exams I go into OWASP 346 346 00:11:54,090 --> 00:11:56,340 and I actually pull out things from the top 10. 347 347 00:11:56,340 --> 00:11:58,410 Why, because so does CompTIA 348 348 00:11:58,410 --> 00:11:59,790 and so this is a great place 349 349 00:11:59,790 --> 00:12:01,170 for you to get some information. 350 350 00:12:01,170 --> 00:12:03,690 And in the real world, it's a great place to learn some 351 351 00:12:03,690 --> 00:12:05,790 of these security coding techniques to make sure 352 352 00:12:05,790 --> 00:12:07,230 that you're doing software development 353 353 00:12:07,230 --> 00:12:08,880 the right way from the beginning.