SDL Secure Software Development Practices 4 — Questions and Answers
Question 1: In Microsoft SDL, what is the 'bug bar' used for?
- Tracking developer performance metrics
- Defining severity thresholds that determine which security bugs must be fixed before release (Correct answer)
- Setting the maximum number of allowed open defects
- Scheduling penetration testing milestones
Correct answer: Defining severity thresholds that determine which security bugs must be fixed before release
The bug bar establishes minimum severity levels (e.g., Critical, Important) that must be resolved before a product can ship, ensuring high-risk vulnerabilities are not deferred.
Question 2: Which SDL phase is responsible for creating data flow diagrams (DFDs) to visualize how data moves through a system?
- Training
- Requirements
- Design (threat modeling) (Correct answer)
- Verification
Correct answer: Design (threat modeling)
Threat modeling during the Design phase uses DFDs to map trust boundaries, data flows, and entry points, enabling systematic threat identification.
Question 3: What is 'defense in depth' in the context of SDL?
- Using only a single strong security control to protect the most critical asset
- Layering multiple independent security controls so bypassing one does not compromise the system (Correct answer)
- Prioritizing perimeter defenses above all internal controls
- Encrypting data with multiple sequential algorithms
Correct answer: Layering multiple independent security controls so bypassing one does not compromise the system
Defense in depth applies multiple, overlapping security layers so that a failure in any single control does not result in a complete system compromise.
Question 4: When SDL requires 'secure defaults,' what does this mean in practice?
- Security features are off by default and must be enabled by administrators
- The most secure settings are enabled out-of-the-box and users must explicitly reduce security (Correct answer)
- Default passwords are provided but must be changed at first login
- Security logs are disabled by default to reduce overhead
Correct answer: The most secure settings are enabled out-of-the-box and users must explicitly reduce security
Secure defaults mean the system ships in its most protected configuration, reducing risk for users who do not customize settings.
Question 5: In SDL, which activity specifically validates that security requirements have been implemented correctly by inspecting the final build?
- Training phase
- Design review
- Final Security Review (FSR) (Correct answer)
- Incident response
Correct answer: Final Security Review (FSR)
The FSR is a formal gate where a security team confirms all SDL requirements are met, outstanding risks are accepted, and the product is cleared for release.
Question 6: What SDL risk does 'information disclosure' in the STRIDE model refer to?
- An attacker performing actions they are not authorized to perform
- Sensitive data being exposed to unauthorized parties (Correct answer)
- An attacker causing a system to become unavailable
- An attacker denying they performed a malicious action
Correct answer: Sensitive data being exposed to unauthorized parties
Information disclosure in STRIDE represents threats where confidential data — credentials, PII, or proprietary content — is accessed by unauthorized users.
Question 7: Why does SDL recommend keeping the attack surface as small as possible?
- Smaller surfaces improve application performance significantly
- Fewer exposed features and interfaces reduce the opportunities an attacker has to find and exploit vulnerabilities (Correct answer)
- Regulatory frameworks require limiting API endpoints
- Smaller attack surfaces reduce software licensing costs
Correct answer: Fewer exposed features and interfaces reduce the opportunities an attacker has to find and exploit vulnerabilities
Minimizing the attack surface limits the number of pathways attackers can use, reducing overall risk proportionally to the reduction in exposed functionality.
SDL Secure Software Development Practices 4
In Microsoft SDL, what is the 'bug bar' used for?