CDP Secure Software Development Lifecycle Flashcards

Which OWASP resource provides a framework for integrating security into the SDLC through maturity levels?

Answer: OWASP SAMM (Software Assurance Maturity Model)

OWASP SAMM defines measurable maturity levels across security practices to help organizations improve their Secure SDLC systematically.

In secure coding, what does 'input validation' primarily protect against?

Answer: Injection attacks such as SQL injection and XSS

Validating and sanitizing user input prevents malicious data from being interpreted as commands, blocking injection-class vulnerabilities.

The principle of 'least privilege' in application development means:

Answer: Each component runs with only the permissions it needs to function

Least privilege limits the blast radius of a compromise by ensuring components cannot access resources beyond their functional requirements.

Secrets management in the SDLC ensures that:

Answer: API keys and credentials are never hardcoded in source code

Hardcoded credentials in source code are easily leaked via version control; secrets should be stored in dedicated vaults and injected at runtime.

A 'shift-left' security approach in DevSecOps means:

Answer: Moving security testing earlier in the development lifecycle

Shifting left integrates security checks at the earliest possible stages (design, code, build) rather than only at the end of the cycle.

Which practice helps developers find and fix security issues before code is merged?

Answer: Security-focused code review (peer review)

Security-focused code review catches flaws such as logic errors and insecure patterns before they are merged into the main branch.