Which secure coding best practice says to only use tested and approved components and use task-specific, built-in APIs to conduct operating system functions?
The software security team is performing security testing for a new software product that is close to production release. They are concentrating on integrations between the new product and database servers, web servers, and web services.
Which security testing technique is being used?
A potential threat was discovered during vulnerability testing when an environment configuration file was found that contained the database username and password stored in plain text.
How should existing security controls be adjusted to prevent this in the future?
Which type of manual code review technique is being used when the reviewer starts at an input control and traces its value through the application to each of the value's outputs?