CAS-002 · Question #723
A company has decided to move to an agile software development methodology. The company gives all of its developers security training. After a year of agile, a management review finds that the…
The correct answer is D. The security requirements definition phase should be added to each sprint. In agile development, security must be formally integrated into every sprint from the requirements phase, not treated as a separate or one-time training activity.
Question
A company has decided to move to an agile software development methodology. The company gives all of its developers security training. After a year of agile, a management review finds that the number of items on a vulnerability scan has actually increased since the methodology change. Which of the following best practices has MOST likely been overlooked in the agile implementation?
Options
- APenetration tests should be performed after each sprint.
- BA security engineer should be paired with a developer during each cycle.
- CThe security requirements should be introduced during the implementation phase.
- DThe security requirements definition phase should be added to each sprint.
How the community answered
(28 responses)- A14% (4)
- B36% (10)
- C7% (2)
- D43% (12)
Why each option
In agile development, security must be formally integrated into every sprint from the requirements phase, not treated as a separate or one-time training activity.
Penetration testing after each sprint is a reactive measure that is resource-intensive and does not address the root cause of failing to define security requirements before each sprint begins.
Pairing a security engineer with a developer addresses implementation-level concerns but does not fix the absence of a formal security requirements definition phase at the planning stage of each sprint.
Introducing security requirements during the implementation phase is too late in the development cycle - requirements must be defined before coding begins to prevent vulnerabilities from being built in.
Adding a security requirements definition phase to each sprint ensures security controls are identified and planned proactively at the start of every development cycle. Without this, developers may write functional but insecure code each sprint, causing vulnerabilities to accumulate over time rather than being prevented at the source.
Concept tested: Security requirements integration in agile sprint cycles
Source: https://owasp.org/www-project-integration-standards/writeups/owasp_in_sdlc/
Topics
Community Discussion
No community discussion yet for this question.