CompTIA CySA+ CS0-002 Passing Score

The software development life cycle (SDLC) is a process that consists of several phases that guide the development of software applications or systems. Security should be involved in every phase of the SDLC, but especially in the planning phase, which is the first phase where the scope, objectives, requirements, and resources of the project are defined. By involving security in the planning phase, potential risks and threats can be identified and mitigated early in the process, which can save time, money, and effort later on. Design, maintenance, implementation, analysis, and testing are other phases of the SDLC, but they are not the first phase where security should be involved. Reference: https://www.bmc.com/blogs/software-development-life-cycle-phases/

Validating user input before execution and interpretation can help to prevent dynamic code evaluation script injection vulnerabilities by checking and filtering any malicious input from the user that may contain code or commands. Dynamic code evaluation script injection is a type of vulnerability that occurs when an application accepts user input and executes or interprets it as part of its own code without proper validation or sanitization. This can allow an attacker to inject arbitrary code or commands into the application and execute them with the same privileges as the application . Validating user input before execution and interpretation can help to ensure that the input conforms to the expected format, length and type, and does not contain any malicious characters or syntax that may alter the logic or behavior of the application .

A CASB, or Cloud Access Security Broker, is a software tool or service that acts as an intermediary between an organization’s cloud services and its users. A CASB can provide various security functions, such as visibility, compliance, threat protection, and data security2 A CASB can help protect the company’s data stored in the cloud by preventing certain types of data from being downloaded to a workstation, such as sensitive or confidential information. This can reduce the risk of data leakage, theft, or loss if a workstation is compromised or stolen.

Logical segmentation is a technique that divides a network into smaller, isolated segments based on logical criteria, such as function, role, or application. Logical segmentation can be implemented using various technologies, such as VLANs, subnets, virtual firewalls, or software-defined networking (SDN). Logical segmentation can enhance the security of a network by reducing the attack surface, limiting the lateral movement of threats, enforcing the principle of least privilege, and facilitating the monitoring and auditing of network traffic12.

Firewall is a device or software that filters and controls the incoming and outgoing network traffic based on predefined rules or policies. Firewall can be deployed at the network perimeter or within the network to create internal zones or segments. Firewall can protect a network from unauthorized access, malicious attacks, or data exfiltration by allowing or blocking traffic based on the source, destination, port, protocol, or application3 .

To best provide the protection that meets the requirements of the security engineer, each product line should be logically segmented and firewalled to control inbound and outbound connectivity. This way, each product line can be secured using a single posture that is consistent and manageable. Each product line can also communicate with the other lines in a least privilege method by allowing only the necessary traffic and blocking the rest. Access to each product line from the rest of the network can be strictly controlled by applying firewall rules that restrict or limit the traffic based on the business needs.