2.3 Summarize secure application development, deployment, and automation concepts.

Question 1

Summarize a DEVELOPMENT environment

Answer 1

A development environment must be defined with a huge number of very specific requirements and goals and then fulfill them on a timely basis. The result of these requirements and goals often manifests as a baseline.

Question 2

Summarize a TEST environment

Answer 2

Once an application has been written, or at least a functional part of the application is complete, it’s time to move out of development and into testing, also often called debugging. At this stage, the application is tested for code quality—proper logic, efficiency, and response time. Testing is also the perfect place to verify security.

Question 3

Summarize a STAGING environment

Answer 3

Staging moves the code from the developers’ computers onto servers, bringing the product closer to deployment, but with controls to do critical testing. Staging often employs sandboxing, the use of virtual machines (VMs) to enable aggressive testing of the application without risking any problems with the rest of the network.

Question 4

Summarize a PRODUCTION environment

Answer 4

There’s a point where the testing is done and it’s time to pull the trigger and get that Web application online and running. This is where all the security issues discussed in this book come into play, such as firewalls, DMZs, load balancing, and intrusion detection/prevention.

Question 5

Summarize a QUALITY ASSURANCE(QA) environment

Answer 5

Quality assurance (QA) defines the processes used to ensure that the production code meets customer requirements while staying as close to error-free as possible. Two items to note here. First, just because quality assurance is at the end of the five-part application development process, it’s really everywhere in the process. A good QA program includes user training, test standards, and good organization of quality testing personnel and processes.

Question 6

Summarize PROVISIONING AND DEPROVISIONING

Answer 6

The process of moving an application from the development environment to the production environment is called PROVISIONING.

The process of removing an application from the production environment is called DEPROVISIONING.

Question 7

Summarize INTEGRITY MEASUREMENT

Answer 7

Integrity measurement shows the honesty, morality, and quality of the application.

Question 8

Summarize SECURE CODING TECHNIQUES

Answer 8

Whether the platform is client side or server side, good development practices require thinking about security from the moment the application is first considered. The CompTIA Security+ exam objectives mention several specific secure coding techniques, all of which are well known and commonly used on all Web applications.

Question 9

Summarize NORMALIZATION

Answer 9

Normalization is a database term meaning to store and organize data so that it exists in one form only. Failure to normalize exposes databases to excess size, potential logic errors, and overall inefficiency.

Question 10

Summarize STORED PROCEDURES

Answer 10

Stored procedures harden Web apps. A stored procedure is a piece of code, custom written by the developers of the app and stored in the database. These stored procedures only respond to a specific query format defined by the developer. Stored procedures make it much harder for bad actors to use common SQL queries to access a database.

Question 11

Summarize OBFUSCATION/CAMOUFLAGE

Answer 11

There are ways to obfuscate or camouflage code, on the other hand, so that it’s extremely difficult to read.

Question 12

Summarize CODE REUSE

Answer 12

In every case, though, reusing someone else’s code—code reuse—adds security, saves money, and reduces development time. The downside to code reuse is that bad actors know that Web apps rely on it. These libraries must run in memory to work for the app. Bad actors know they’re running and try to get access to this code and can cause lots of trouble if they do get access.

Question 13

Summarize SERVER-SIDE VS. CLIENT-SIDE EXECUTION AND VALIDATION

Answer 13

In classic server-side applications, the code executes on the server and the server handles most, if not all, validation. As you might guess, client-side applications execute code on the client and the client has to handle the validation. Look for a question on the exam that asks about server-side versus client-side execution and validation. This essentially asks which machine is doing the work.

Question 14

Summarize MEMORY MANAGEMENT

Answer 14

Web apps are programs, and programs must run in either the server’s or the client’s memory. Many attacks—buffer overflow and code reuse, for example—work by accessing a system’s memory in some unauthorized fashion. The CompTIA Security+ exam objectives mention memory management as a secure coding technique, but it’s part of the discussion of specific attacks.

Question 15

Summarize USE OF THIRD-PARTY LIBRARIES AND SOFTWARE DEVELOPMENT KITS (SDKs)

Answer 15

Software development kit (SDK), a combination of documentation, development environment, and premade code (known as libraries) for common tasks and for interfacing with other software via an application programming interface (API) and tutorials. SDKs come with licensing (proprietary or free) and you cannot mix license types. This isn’t that big of a problem if you stick to libraries provided by the SDK. This can be a huge issue if you decide to use third-party libraries.

Question 16

Summarize DATA EXPOSURE

Answer 16

Exposed data that needs hiding—maybe a database, maybe a simple temporary data structure, or in some cases even the local code itself—must be encrypted.

Question 17

Summarize OPEN WEB APPLICATION SECURITY PROJECT(OWASP)

Answer 17

There are well-established procedures to perform good error handling. One great resource is the Open Web Application Security Project (OWASP).

Question 18

Summarize SOFTWARE DIVERSITY

Answer 18

To make executables most robust against attacks, an organization may choose to use a special compiler that creates different binary executables every time. Sure, the executables all do the same thing, but by making each executable unique, it’s harder for attackers to identify the program by file size, hash, and so forth.

Question 19

Summarize a COMPILER

Answer 19

It creates executables.

Question 20

Summarize a BINARY

Answer 20

It can mean either a file or a series of 1s and 0s

Question 21

Summarize AUTOMATION/SCRIPTING

Answer 21

Automated testing uses special testing software that works with scripts commonly written by the programmers (or perhaps the quality assurance team) to create automated courses of action for the deployment process. These steps may happen weekly, daily, or, as CompTIA wants to discuss, continuously.

Question 22

Summarize AUTOMATED COURSES OF ACTION

Answer 22

These are plans of action that are automated when testing and applying code to an application continuously.

Question 23

Summarize CONTINUOUS MONITORING

Answer 23

Automated processes that monitor the functioning Web application itself.

Question 24

Summarize CONTINUOUS VALIDATION

Answer 24

Tests to verify the code is running as expected.

Question 25

Summarize CONTINUOUS INTEGRATION

Answer 25

Processes to verify different parts of the application software are working together properly.

Question 26

Summarize CONTINUOUS DELIVERY

Answer 26

Automated tools to deploy the latest version to a customer.

Question 27

Summarize DEPLOYMENT

Answer 27

The process that makes continuous delivery happen.

Question 28

Summarize ELASTICITY

Answer 28

Elasticity addresses the ups and downs of demand.

Question 29

Summarize SCALABILITY

Answer 29

Scalability means meeting changes in demand over longer time frames.

Question 30

Summarize VERSION CONTROL

Answer 30

Add strict change management and version controls to ensure faults aren’t introduced into the application.

Question 31

Summarize DEAD CODE

Answer 31

Dead code is programming that’s part of the finished application but doesn’t do anything. Dead code is to programming as typos are to writing: writers try to avoid them. Dead code adds compilation/interpretation time, makes the code bigger than it needs to be, and might confuse the next programmer reading the code, but none of these will get your system hacked.