Question

• Prepare a 250-300 word overview of the Microsoft SDLC practices. Summarize all 12 of the practices in SDLC.

• Select one of the following practices. In one paragraph, research and summarize available tools in the market:

‒ Practice #4 - Threat modeling

‒ Practice #9 - Perform Static Analysis Security Testing (SAST)

‒ Practice #10 - Perform Dynamic Analysis Security Testing (DAST)

‒ Practice #11 - Perform Penetration Testing

Answer 1

1. Overview of Microsoft SDLC:-

a. In microsoft sdlc is security development life cycle set of practices that support security assurance and compilance  requirements.It helps developers to build more secure software number and severity of vulnerabilities in software.

b. Microsoft sdl introduces security and privacy throghout all phases of the development process

2. Following are 12 practices of microsoft sdl:-

1.Define security requirements .

2.Perform threat modeling.

3. Provide training .

4. Define metrics and compilance reporting

5.Establish design requirements.

6.Define and use cryptography standards

7.Manage the security risk of using third party components

8.Use approved tools.

9. Perform static analysis security testing

10.Perform dynamic analysis security testing

11.Perform penetration testing.

12.Establish standard incident response process.

(3). Pentration testing:-

a. Penetration testing is security analysis of software system performedby skilled security professionals of hacker.

b.The objective is to uncover potential vulnerabilities resulting from coding errors,system configuration,faults.

c. It often performed in conjuction with automated and manual code reviews to provide greater level of analysis.

d. Four things every penetration test report should have:-

1. Execuitve summary for strategic direction.

2.Walkthrough of technical risk

3.Potential impact of vulnerability.

4. Multiple Vulnerability remediation .

e. Different types of penetration include network services,applications,client side,wireless,social engineering etc.

f. Penetration testing tools:-

1.Netsparker

2.Wireshark.

3.Metasploit

4 .Aircrack

5. Acunetix scanner.