9. While reviewing a recent compromise a forensics team discovers that there are hard-coded credentials in the database connection strings. Which of the following assessment types should be performed during software development to prevent this from reoccurring?
Answer: C
Static analysis should be performed during software development to prevent hard-coded credentials.
Static analysis is a method that examines the codebase for vulnerabilities such as hard-coded credentials before the software is executed. By integrating static analysis into the development process, teams can identify and address security issues early.
A) Vulnerability scan
A vulnerability scan is a tool that identifies known vulnerabilities in software that is already deployed. While it is useful for discovering security weaknesses, it does not analyze the source code itself, meaning it would not catch hard-coded credentials present in the codebase during development.
B) Penetration test
A penetration test simulates attacks on a system to identify security weaknesses and vulnerabilities. While valuable for assessing the security posture of a deployed application, it occurs after development and does not prevent issues like hard-coded credentials from being introduced in the first place.
C) Static analysis
Static analysis is a code review technique that analyzes the source code for potential vulnerabilities, including hard-coded credentials. This proactive approach allows developers to catch and fix security issues before the software is deployed, making it the most effective choice for preventing such problems.
D) Quality assurance
Quality assurance (QA) focuses on ensuring that the software meets specified requirements and functions correctly. Although QA is essential for overall software quality, it does not specifically address security vulnerabilities like hard-coded credentials, which require targeted analysis techniques such as static analysis.
Conclusion
Static analysis is the most appropriate assessment type for identifying and preventing the inclusion of hard-coded credentials during software development. Other options, such as vulnerability scans and penetration tests, are reactive measures that do not address the root cause of the issue during the development phase. Therefore, integrating static analysis into the development lifecycle is crucial for enhancing security and preventing similar compromises.