Reference no: EM133500374
Assignment: Security Concepts & Recommendations for Techworx Partnership
Recently a company named Techworx has reached out and was interested in partnering with your company. They have no experience with secure software development. You will have to explain these concepts to them over the coming weeks. Ms. Pam Beasley is the Director of Software development for Software is Us. You will report to her with your ideas and recommendations.
In the readings and in particular, chapter 3 Security Basics>How can we get there>Development Processes/Defense in Breadth talks about certain processes that all developers have to do.
Task
I. Why is it important to incorporate security throughout the SDLC instead of just in one phase or another? Please discuss.
II. What role do DevSecOps and Continuous Delivery/Continuous integration play?
Read/Review the ISO-25010 standard.
I. i. What is something in your life that you consider to be of high quality?
ii. What makes this thing high quality to you?
iii. What is one company that is known for its high-quality products?
II. i. Find a definition of Software Quality that makes sense to you. (make sure you add the reference to your discussion)
ii. Looking at the characteristics of software quality in the ISO-25010 chart below, excluding security, what would be the top 3 considerations when developing software? Justify your answer and where would security fit in.
iii. Reflect on the definition of software quality that you chose in step 2a and the characteristics you chose in step 2b.
Part A: Identify the primary threat agents to your business (Pick any).
I. Which persons or entities stand to profit from attacking your software systems and what types of attacks would be most beneficial to them?
II. What information could they obtain from your software systems or release publicly to cause damage to the organization?
Part B: Log4j Shell (NICE Challenge)
Watch this video on The Log4j Shell vulnerability: Log4J Vulnerability (Log4Shell) Explained - for Java developers - Bing video.
Include an executive summary of the vulnerability and exploit. Ensure you describe any mitigation strategies.
Include screenshots of the NICE challenge and Screenshots of the green check.