ListenReadSpeaker webReader: ListenOverviewWriting code is difficult. Writing secure code can be even more challenging. As the developer, it is your responsibility to write secure code....

Overview

Writing code is difficult. Writing secure code can be even more

challenging. As the developer, it is your responsibility to write secure

code. You’ll know if your code is secure when you manually search for

and identify possible security vulnerabilities. Developing this skill is

important because it becomes more challenging as the number of lines

and complexity of your code increase.

Fortunately, as you learned in this module, you can follow a

workflow. You can also use tools that are widely accepted in the field

of software security and vulnerability assessments. By following the

Vulnerability Assessment Process Flow Diagram (VAPFD), you can focus

your manual code inspection and narrow your search for possible security

vulnerabilities within your code.

Specifically in this assignment, you will:

• Determine relevant areas of security for a software application.


• Identify software security vulnerabilities by manually reviewing source code.


• Identify potential mitigation techniques that have been used to mitigate against vulnerabilities associated with known exploits.

Scenario

You’re a senior software developer in a team of software developers.

You’re responsible for a complex web application that uses Spring

Framework. The team has been tasked with implementing an expressive

command input function for the application. You are told the team is

currently using Version 2.6.5 of the spring-data-rest-webmvc in Spring

Framework. You also want to use the Spring Expression Language to

accomplish the task.

If you are unfamiliar with Spring, learn about Spring Framework by

watching the video and exploring the guides linked in the Supporting

Materials section.

Directions

As the lead person on this application, you are responsible for

ensuring that the code is secure. You’ll need to assess potential

vulnerabilities in the code and create a mitigation plan for any

existing vulnerabilities that the software development team must

address.

To begin, see the Vulnerability Assessment Process Flow Diagram

(VAPFD), linked in Supporting Materials, to help guide your code review

and mitigation plan.

Specifically, you must address the following rubric criteria:

1. 
   Areas of Security:
   Review the scenario and use what you know
   
   about the architecture of the web application to identify relevant areas
   
   of security that are applicable for a software application:




1. Decide which of the seven areas of security are relevant to assess from the first level of the VAPFD.


2. Document your findings for the software development team in
   
   theModule Two Written Assignment Template, linked in What to Submit.
   
   




2. 
   Areas of Security Justification:
   Justify your reasoning for why each area of security is relevant to the software application.
   
   


3. 
   Code Review Summary:Once you have identified the relevant
   
   areas of security to review from the first level of the VAPFD, work
   
   through the second level. At this stage, you should:




1. Manually inspect the code base provided to identify which
   
   vulnerabilities exist by uploading the Module Two Written Assignment
   
   Code Base, linked in Supporting Materials, as a new project into
   
   Eclipse.


2. Refer to the Uploading Files to Eclipse Desktop Version Tutorial,
   
   linked in Supporting Materials, for how to open the code base for
   
   review.


3. Document your findings for the software development team in the Module Two Written Assignment Template provided.
   
   




4. 
   Mitigation Plan:
   Once you have manually inspected the code and identified the security vulnerabilities:




1. Describe potential mitigation techniques.
   For example,
   
   describe secure software designs that you could use to address the
   
   software security vulnerabilities you identified.


2. It may be helpful to refer to the Module Two Resources, including
   
   your textbook, the Secure Coding Guidelines for Java SE, the Common
   
   Vulnerabilities and Exposures (CVE) list, and the National Vulnerability
   
   Database.


3. Document your findings for the software development team in the
   
   Module Two Written Assignment Template provided. This plan will be used
   
   by the software development team to address all vulnerabilities in the
   
   code.

What to Submit

Submit a completed
Module Two Written Assignment Templateas a 1- to 2-page Microsoft Word document.