Question 61

Code signing will address this concern.

Code signing is a technique used to ensure that the software has not been altered or corrupted since it was signed by the original developer. This process provides a level of assurance that the software is legitimate and has not been tampered with, addressing the customer's concern about malware.

A) Secure storage

Secure storage refers to the method of protecting sensitive data through encryption and access controls. While it is essential for data protection, it does not prevent malware from being present in downloaded software or confirm the integrity of the software itself.

B) Static code analysis

Static code analysis involves examining the source code of software for potential vulnerabilities without executing it. While it can help identify security flaws during development, it does not provide a method for verifying the authenticity or integrity of the software once it has been distributed.

C) Input validation

Input validation is a technique used to ensure that data provided to an application is correct and secure. Although crucial for preventing attacks such as injection, it does not address the issue of verifying whether the software itself contains malware after it has been downloaded.

D) Code signing

Code signing ensures that the software has been created by a verified source and has not been modified since it was signed. This method provides users with assurance regarding the authenticity and integrity of the software, effectively addressing the customer's concerns about malware.

Conclusion

Code signing is the most effective technique for resolving the customer's concerns, as it guarantees that the software is from a trusted source and has not been altered. Other options, such as secure storage, static code analysis, and input validation, do not directly address the integrity and authenticity of the software after it has been downloaded. Thus, code signing stands out as the appropriate solution in this scenario.