Security Testing & Code Analysis Flashcards

Which approach to security testing analyzes binaries or compiled code without access to source code?

Answer: Binary / black-box static analysis (BAST)

Binary static analysis examines compiled executables to find vulnerabilities when source code is unavailable, commonly used for third-party components.

A developer introduces a check that validates input length only on the client side (browser). Why is this insufficient from an SDL perspective?

Answer: Attackers can bypass client-side validation by intercepting and modifying requests before they reach the server

Client-side controls can be bypassed with proxies or direct HTTP requests; SDL requires server-side validation as the authoritative enforcement point.

Which OWASP testing technique involves manually walking through an application's authentication flow to identify logic flaws?

Answer: Manual testing / business logic testing

Business logic testing requires human testers to reason about intended workflows and test for flaws that automated tools cannot detect because they require contextual understanding.

What is 'differential fuzzing'?

Answer: Comparing outputs of two implementations with the same inputs to detect behavioral discrepancies

Differential fuzzing feeds identical inputs to multiple implementations and flags cases where outputs differ, revealing inconsistencies that may indicate security bugs.

In SDL, which process ensures that security requirements derived from threat modeling are verifiable through testing?

Answer: Security test case derivation from threats

Deriving security test cases directly from threat model mitigations ensures every identified threat has a corresponding test that validates the control is effective.

Which code analysis technique builds a graph of all possible execution flows through a program to identify unreachable code or dangerous paths?

Answer: Control flow graph (CFG) analysis

Control flow graph analysis constructs a directed graph of all execution paths, enabling tools to detect dead code, missing error handling, and security-sensitive execution paths.

When reviewing cryptographic code, which practice violates SDL secure coding standards?

Answer: Implementing a custom encryption algorithm instead of a vetted standard

SDL prohibits 'rolling your own crypto' because custom algorithms almost always contain subtle flaws; only peer-reviewed, industry-standard algorithms should be used.