Secure Software Development and Application Security
Applications are a major attack target
Application risk
Applications often process trusted and untrusted input together, which creates opportunities for injection, insecure deserialization, logic flaws, and access control failures. Secure design reduces these risks before code is written.
Common application weaknesses
| Weakness | Typical impact |
|---|---|
| Injection | Unauthorized queries or commands |
| Broken access control | Users access data or actions they should not |
| Sensitive data exposure | Secrets leaked in logs, responses, or storage |
| Security misconfiguration | Default settings and overly permissive exposure |
Secure development vs reactive fixing
Secure development
- Threat models features before coding
- Uses secure defaults and review gates
Reactive fixing
- Finds problems after release
- Usually costs more and creates delays
High-value habit
Input validation, output encoding, least privilege, and centralized secrets handling prevent many common web application failures.
Basic secure SDLC workflow
-
1
Define security requirements early.
-
2
Review architecture and identify trust boundaries.
-
3
Implement secure coding standards and code review.
-
4
Test with static analysis, dynamic testing, and manual review.
-
5
Patch issues and track them to closure.
Which issue most directly describes broken access control?
Broken access control lets users perform actions outside their permissions.
Correct answer: A user can view another user's private record
Why should secrets not be hard-coded into source code?
Secret management should separate credentials from application code.
Correct answer: Because code is widely copied and secrets can be exposed through repositories, logs, or builds
Which activity belongs early in secure development?
Threat modeling identifies security design risks before implementation.
Correct answer: Threat modeling
Name one benefit of code review for security.
Review provides a human check beyond automated tools.
Correct answer: It can catch logic errors, insecure patterns, and missing controls before release