A software developer has been deploying web applications with common security risks to include insufficient logging capabilities. Which of the following actions would be most effective to reduce…

Question

Options

• APerform static analyses using an integrated development environment
• BDeploy compensating controls into the environment
• CImplement server-side logging and automatic updates
• DConduct regular code reviews using OWASP best practices

• A
  22% (7)
• B
  6% (2)
• C
  16% (5)
• D
  56% (18)

Explanation

Explanation

Conducting regular code reviews using OWASP (Open Web Application Security Project) best practices directly addresses the root cause of the problem - insecure application development practices - by systematically identifying vulnerabilities like insufficient logging, injection flaws, and broken authentication before deployment. OWASP provides a well-established framework specifically designed to guide developers in recognizing and remediating common web application security risks, making it the most comprehensive and proactive solution.

Why the distractors are wrong:

• A (Static analysis/IDE): While static analysis helps catch code errors, it is primarily a tool for syntax and basic vulnerability scanning, not a holistic security review process aligned with web application security standards.
• B (Compensating controls): Compensating controls are reactive workarounds used when primary controls aren't feasible - they don't fix the underlying development practices causing the vulnerabilities.
• C (Server-side logging/automatic updates): While server-side logging addresses one specific symptom mentioned, it doesn't tackle the broader pattern of insecure development practices; automatic updates are also unrelated to coding security risks.

Memory Tip

Think "OWASP = fix the source." Whenever a question involves multiple web application security risks stemming from development practices, OWASP-based code reviews treat the root cause, not just the symptoms. If the problem is how code is built, the answer involves how code is reviewed.

No community discussion yet for this question.