You have been promoted as the manager of the e-commerce site for the company you working for.

Sample Solution

      You have been promoted as the manager of the e-commerce site for the company you working for. You are concerned about a recent SQL attack that happened. Your team reacted to the situation by notifying you immediately. You and your team were successful in containing and correcting the issues that allowed the website and database to be compromised by an SQL injection attack. Knowing that many of the issues can be created by human error, you have decided to evaluate the processes your team uses when they code. As their leader, it is your responsibility to be current on all the best secure coding practices. Your job is to create guidelines for best coding practices, which you will present to your team. Follow the instructions below Provide at least three reasons why it is less expensive to build secure software than to correct security issues after a breach. Outline the objectives and purpose of your company's "best secure coding practices" and explain how it will influence your division. Evaluate which method of the secure software development lifecycle will best serve your team, and explain how you plan on implementing your thoughts into your existing processes. Identify three resources that can be used as "reference material" and act as a beginner's guide for new employees. Outline the importance of each resource and how each resource can assist new coders. Outline all the major aspects of the best practice coding guideline, including objectives, purpose, resources, and methodology  

Full Answer Section

     

Here are three reasons why building secure software is cheaper than fixing breaches:

1. Reduced Cost of Incident Response: Breaches trigger expensive efforts to contain the damage, investigate the cause, and notify affected users. Secure coding minimizes these costs.

2. Avoided Reputational Damage: A security breach can severely damage customer trust, leading to lost sales and brand rebuilding costs. Secure coding safeguards your reputation.

3. Lower Development Rework: Fixing vulnerabilities after deployment requires rework, testing, and redeployment, delaying features and increasing development costs. Secure coding practices catch issues early.

Objectives and Purpose of Best Secure Coding Practices

Objectives:

• Minimize vulnerabilities in our e-commerce code.
• Prevent security breaches and data loss.
• Enhance customer trust and brand reputation.

Purpose:

These guidelines will establish a secure coding culture within our team. This will directly influence our division by:

• Reducing development rework due to security fixes.
• Shortening development cycles through early identification of vulnerabilities.
• Building a more secure and reliable e-commerce platform.

Secure Software Development Lifecycle (SDLC) Method

The Secure SDLC (SecSDLC) methodology best serves our team. It integrates security practices throughout the development process, not just as an afterthought. Here's how we'll implement it:

• Security Requirements Definition: We'll define security requirements at the beginning of each project, identifying threats and vulnerabilities specific to our e-commerce platform.
• Secure Coding Training: We'll provide developers with training on secure coding practices outlined in these guidelines.
• Threat Modeling: We'll conduct threat modeling exercises to proactively identify potential attack vectors and implement mitigations during design and coding phases.
• Static Code Analysis: We'll utilize static code analysis tools to automatically detect common coding vulnerabilities in the development phase.
• Security Testing: We'll integrate security testing throughout the development lifecycle, including manual and automated penetration testing.

Reference Materials for New Employees

1. OWASP Top 10 Web Application Security Risks (OWASP Top 10): This free resource from the Open Web Application Security Project (https://owasp.org/www-project-top-ten/) provides a catalog of the ten most critical web application security risks. It helps developers understand common vulnerabilities and coding practices to avoid them.

2. Secure Coding Practices Quick Reference Guide by OWASP: This guide (https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/stable-en/02-checklist/05-checklist) is a beginner-friendly checklist outlining essential secure coding practices across various programming languages. It provides concrete steps for developers to follow when writing secure code.

3. Company-Specific Secure Coding Guidelines: In addition to these external resources, we will develop internal secure coding guidelines that detail specific coding practices and tools relevant to our e-commerce platform and coding languages used by our team.

Objectives: Build a secure development culture, minimize vulnerabilities, and enhance application security.

Purpose: Guide developers in writing secure code that protects the e-commerce platform and user data.

Resources:

• OWASP Top 10
• OWASP Secure Coding Practices Quick Reference Guide
• Company-Specific Secure Coding Guidelines

Methodology: We will adopt the Secure SDLC methodology, integrating security practices throughout the development process.

By implementing these best secure coding practices, we can significantly reduce vulnerabilities, minimize the risk of breach