Summary

This chapter started with a discussion about the effectiveness of software security. You examined how to audit software changes and the importance of logging software changes. When users write thousands of lines of code, errors are more likely.

One system that helps to measure the software development process for developers is the CMMI model. The closer the development team gets to the top of the scale, or 5, the better that developer’s processes are. Then you learned about software vulnerabilities; the top 3 have to do with poor authentication, broken encryption, and injection attacks. Other vulnerabilities are SQL injection and buffer overflow attacks.

Next, you learned about working with software developers and COTS software. In most cases, you’re not going to be able to see the source code, so it’s important to make sure that these developers have strong software development processes and secure policies; again, the CMMI model can help find the...