{"id":336,"date":"2020-06-12T20:16:23","date_gmt":"2020-06-12T20:16:23","guid":{"rendered":"http:\/\/www.spktechfit.com\/?p=336"},"modified":"2020-09-27T19:48:45","modified_gmt":"2020-09-27T19:48:45","slug":"security-course-3-5-secure-staging-and-development","status":"publish","type":"post","link":"https:\/\/www.spktechfit.com\/?p=336","title":{"rendered":"Security+ Course \u2013 3.5. Secure Staging and Development"},"content":{"rendered":"<h2>1. Software Staging and Release<\/h2>\n<p>Deploying code without processes (the wrong way to do it)<\/p>\n<ul>\n<li>Surprises end users<\/li>\n<li>Introduces security flaws<\/li>\n<li>Causes operational disruptions<\/li>\n<li>Increases the difficulty of rolling back flawed code<\/li>\n<\/ul>\n<p><strong>Stage 1 &#8211; Development Environment<br \/>\n<\/strong>Allows developers to develop and modify code<\/p>\n<p><strong>Stage 2 &#8211; Test Environment<br \/>\n<\/strong>Facilitates human and automated testing<\/p>\n<p><strong>Stage 3 &#8211; Staging Environment<br \/>\n<\/strong>Prepares the code for release to production in a simulated environment. Load testing occurs at this stage.<\/p>\n<p><strong>Stage 4 &#8211; Production Environment<br \/>\n<\/strong>Provides live services to end users<\/p>\n<p><strong>Important issues in these stages<\/strong><\/p>\n<ol>\n<li>Sensitive data: this should be tightly controlled or prohibited in non-production environments. EG: use test data<\/li>\n<li>Code deployment: this should be done by someone other than a developer. EG: a release management team.<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<hr \/>\n<p>&nbsp;<\/p>\n<h2>2. Software Risk Assessment and Mitigation<\/h2>\n<p><strong>Risk Analysis<\/strong> identifies risk<\/p>\n<p><b>Risk Mitigation <\/b>reduces their likelihood and impact<\/p>\n<h3>Software Development Lifecycles (SLDC)<\/h3>\n<p>In Software Development security must be integrated from the very start. It is not something that can be added in later. Security should be integrated with the Software Development Lifecycle (SLDC). SLDCs include:<\/p>\n<ul>\n<li>Waterfall<\/li>\n<li>Agile<\/li>\n<li>Spiral<\/li>\n<\/ul>\n<p>Security must be integrated at all stages &#8211; Design, development, testing and deployment.<\/p>\n<h3>Mitigate Software Risks<\/h3>\n<p>Some ways to mitigate software risks include:<\/p>\n<ul>\n<li>Perform input validation on user input<\/li>\n<li>Encrypt sensitive data so that if a database does get compromised the data is encrypted<\/li>\n<li>Enforce the principle of least privilege<\/li>\n<li>Test all code prior to deployment<\/li>\n<\/ul>\n<p><strong>Sandboxing<\/strong><\/p>\n<p>This is a test environment where developers can run their code without it having access to production resources. Sandboxes work hand in hand with code repositories. A developer may test a copy of code from a repository in a sandbox, then once finished testing they put it back in the repository.<\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p>&nbsp;<\/p>\n<h2>3. Security Baselines and Integrity Measurement<\/h2>\n<p><strong>A baseline<\/strong> is a minimum or a starting point used for comparisons.<\/p>\n<p><strong>Deviations:\u00a0<\/strong>these are changes from the baseline<\/p>\n<p><strong>Integrity Management: <\/strong>this tracks changes made to code after deployment, noting unexpected changes<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Software Staging and Release Deploying code without processes (the wrong way to do it) Surprises end users Introduces security flaws Causes operational disruptions Increases the difficulty of rolling back flawed code Stage 1 &#8211; Development Environment Allows developers to develop and modify code Stage 2 &#8211; Test Environment Facilitates human and automated testing Stage [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[11,10,3],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts\/336"}],"collection":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=336"}],"version-history":[{"count":4,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts\/336\/revisions"}],"predecessor-version":[{"id":510,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=\/wp\/v2\/posts\/336\/revisions\/510"}],"wp:attachment":[{"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.spktechfit.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}