1. Identify the four recognized business functions and each security practice of OpenSAMM.
a. Governance, construction, verification, and deployment.
2. Identify and describe the four maturity levels for security practices in SAMM.
a. 0 – implicit starting point representing the activities in the practice being unfulfilled. 1 – initial understanding and ad hoc provision of security practice. 2 – increase efficiency and effectiveness of the security practice. 3 – comprehensive mastery of the security practice.
3. What are some activities an organization could perform for the security practice of Threat Assessment?
a. Identify threats and establish responses to these threats.
4. What are the two recommended assessment styles for SAMM, and how are they used?
a. Processes handling vulnerability reports and operational incidents
5. What are the three main objectives of the OWASP Application Security Verification Standard (ASVS) Project?
a. Understand, establish and compliance
6. Identify the four levels used for ASVS.
a. Automated verification, manual verification, design verification, and internal verification
7. According to the OWASP development guide, what are some guidelines for handling credit cards on Web sites?
a. Use compliant equipment, maintain security, and unique keys
8. What are the four known data-validation strategies?
a. Constrain, accept, reject, and sanitize
9. When should the testing process be introduced in the Software Development Lifecycle (SDLC)?
a. Prototype development
10. What is black-box testing?
a. A method of software testing that examines the functionality of an application without peering into its internal structures.
11. According the OWASP Development guide, what are some basic best practices for handling authentication when designing and developing Web-based software?
a. Protect brand, know your business,