67. While reviewing a recent compromise, a forensics team discovers that there are hard-coded credentials in the database connection strings. Which of the following assessment types should be performed during software development to prevent this from reoccurring?
Answer: C
Static analysis should be performed during software development to prevent hard-coded credentials.
Static analysis is a crucial assessment type that examines the source code for vulnerabilities, including hard-coded credentials, before the software is run. This proactive approach helps developers identify and rectify security issues early in the development cycle.
A) Vulnerability scan
A vulnerability scan is primarily focused on identifying known vulnerabilities in a deployed system or network. While it is important, it does not address issues present in the source code itself, such as hard-coded credentials, which can only be effectively detected through analysis of the codebase.
B) Penetration test
A penetration test simulates attacks on an application to find security weaknesses. While it can reveal issues like hard-coded credentials if exploited, it occurs after development and does not prevent such issues from being introduced in the first place, making it less effective for this purpose.
C) Static analysis
Static analysis is designed to analyze source code without executing it, making it highly effective for identifying hard-coded credentials among other coding flaws. By integrating static analysis into the development process, teams can ensure that such vulnerabilities are detected and remediated before deployment.
D) Quality assurance
Quality assurance focuses on ensuring that the software meets the required standards and functions correctly. However, it does not specifically target security vulnerabilities like hard-coded credentials, and therefore cannot guarantee that such issues will not be present in the final product.
Conclusion
Static analysis is the most effective method for identifying and preventing hard-coded credentials during software development. Unlike vulnerability scans and penetration tests, which are reactive and focus on deployed systems, static analysis allows for early detection and remediation of security flaws directly in the code, making it essential for secure software development practices.