67. While reviewing a recent compromise, a forensics team discovers that there are hard-coded credentials in the database connection strings. Which of the following assessment types should be performed during software development to prevent this from reoccurring?
Answer: C
Static analysis should be performed during software development to prevent hard-coded credentials.
Static analysis is a process that involves examining the source code of a program to identify potential vulnerabilities, including hard-coded credentials in database connection strings. By implementing static analysis, developers can catch these issues early in the software development life cycle.
A) Vulnerability scan
A vulnerability scan typically assesses running systems for known vulnerabilities, but it does not analyze source code directly. While it can identify issues in deployed applications, it would not catch hard-coded credentials during the development phase.
B) Penetration test
A penetration test simulates an attack on a system to identify vulnerabilities that could be exploited. However, this assessment is conducted on a finished product rather than during development, making it ineffective for preventing hard-coded credentials from being introduced in the first place.
C) Static analysis
Static analysis is the correct choice as it involves examining the application’s code for patterns that indicate poor security practices, such as hard-coded credentials. This proactive approach allows developers to fix issues before the software is deployed.
D) Quality assurance
Quality assurance focuses on ensuring that the software meets specified requirements and functions correctly. While it may catch some issues, it does not specifically target security vulnerabilities like hard-coded credentials, which can be identified through static analysis.
Conclusion
Static analysis is essential for identifying and mitigating security risks in code, such as hard-coded credentials. Other options, while useful in their respective contexts, do not address the need to examine the source code during development and therefore fail to prevent this specific issue effectively. Implementing static analysis ensures that security practices are integrated from the earliest stages of software development.