CoreQ Academy2.2 Given a scenario, implement security in the early stages of the systems life cycle and throughout subsequent stages.
Security costs least when designed in from requirements onward and verified continuously through the pipeline, supply chain and end of life.
Security requirements definition
- Functional requirements
- What the system must do, including security features like MFA or audit logging.
- Non-functional requirements
- Qualities such as performance, availability and security strength.
- Security vs. usability trade-off
- Balancing friction against protection so users do not work around controls.
Software assurance
- Static application security testing (SAST)
- Analysing code without running it.
- Dynamic application security testing (DAST)
- Testing the running app from outside.
- Interactive application security testing (IAST)
- Instrumented testing inside the running app.
- Runtime application self-protection (RASP)
- Protection built into the running app that detects and blocks attacks in real time.
- Vulnerability analysis
- Reviewing and prioritising found weaknesses.
- Software composition analysis (SCA)
- Finding vulnerable or risky third-party components.
- Software bill of materials (SBoM)
- An inventory of every component in software (e.g. SPDX, CycloneDX) used to respond quickly to new vulnerabilities.
- Formal methods
- Mathematical proofs that software or protocols meet a specification; used for high-assurance systems.
Continuous integration/continuous deployment (CI/CD)
- Coding standards and linting
- Automated checks enforcing safe, consistent code.
- Branch protection
- Required reviews and checks before merging to main.
- Continuous improvement
- Feeding findings back to improve the pipeline and training.
- Testing activities
- Automated tests at each stage.
- Canary
- Release to a small subset first and watch for problems.
- Regression
- Make sure changes did not break existing behaviour or controls.
- Integration
- Test that components work together.
- Automated test and retest
- Re-run tests automatically after fixes.
- Unit
- Test individual functions.
Supply chain risk management
- Software
- Vetting libraries, vendors and build integrity (signing, provenance such as SLSA).
- Hardware
- Trusted suppliers, counterfeit detection and tamper-evident delivery.
Hardware assurance and end of life
- Certification and validation process
- Independent validation of hardware and crypto modules (e.g. FIPS 140-3, Common Criteria).
- End-of-life (EOL) considerations
- Planning replacement before support ends and securely decommissioning.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 2.2 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.