SDL Secure Software Development Practices 3 — Questions and Answers
Question 1: What is the SDL concept of 'security response' primarily concerned with?
- Blocking all external traffic after a breach
- Having a defined process to address newly discovered vulnerabilities post-release (Correct answer)
- Encrypting all data at rest proactively
- Performing penetration tests quarterly
Correct answer: Having a defined process to address newly discovered vulnerabilities post-release
SDL's security response plan defines how organizations triage, patch, and communicate vulnerabilities discovered in released software to minimize customer impact.
Question 2: Which SDL design principle recommends breaking a system into isolated components so a breach in one does not compromise others?
- Least privilege
- Defense in depth
- Compartmentalization (Correct answer)
- Fail-safe defaults
Correct answer: Compartmentalization
Compartmentalization (also called isolation or sandboxing) contains breaches by ensuring components cannot freely access each other's data or functions.
Question 3: In SDL, what must be completed before a product can pass the Final Security Review (FSR)?
- Marketing approval and sales forecast
- All mandatory SDL tasks and any outstanding security bugs mitigated (Correct answer)
- User acceptance testing and UI design sign-off
- Legal review of open-source licenses only
Correct answer: All mandatory SDL tasks and any outstanding security bugs mitigated
The FSR verifies that all required SDL activities have been performed and that high-severity security issues have been addressed or formally accepted.
Question 4: Which type of SDL security test sends real exploit payloads against a running application to validate vulnerabilities found in static analysis?
- Dynamic application security testing (DAST) (Correct answer)
- Source code review
- Binary analysis
- Compliance audit
Correct answer: Dynamic application security testing (DAST)
DAST tests a running application by sending malicious payloads, confirming that vulnerabilities detected statically are actually exploitable at runtime.
Question 5: What SDL guideline applies when third-party or open-source components are incorporated into a product?
- They are exempt from SDL requirements since they are externally maintained
- They must be inventoried, monitored for vulnerabilities, and updated when patches are released (Correct answer)
- Only components with commercial support need security review
- Open-source components may only be used with written vendor permission
Correct answer: They must be inventoried, monitored for vulnerabilities, and updated when patches are released
SDL requires tracking all third-party dependencies because vulnerabilities in them become vulnerabilities in your product, regardless of their origin.
Question 6: During SDL implementation, why should developers avoid writing their own cryptographic algorithms?
- Custom algorithms are too slow for production use
- Cryptography is mathematically complex, and unvetted implementations almost always contain subtle flaws (Correct answer)
- Regulators prohibit proprietary encryption
- Custom algorithms are incompatible with TLS standards
Correct answer: Cryptography is mathematically complex, and unvetted implementations almost always contain subtle flaws
SDL mandates using proven, peer-reviewed cryptographic libraries because amateur implementations routinely introduce timing attacks, weak randomness, and other subtle vulnerabilities.
Question 7: What SDL artifact documents the set of security controls a development team is required to implement for a specific product?
- Attack surface analysis report
- Security bug bar
- SDL security requirements specification (Correct answer)
- Penetration test report
Correct answer: SDL security requirements specification
The SDL security requirements specification defines the mandatory security features, controls, and design constraints a product must satisfy throughout development.
SDL Secure Software Development Practices 3
What is the SDL concept of 'security response' primarily concerned with?