WGU Secure Software Design (D487, KEO1)

One of the four core values of the Agile Manifesto is prioritizing "individuals and interactions over processes and tools." This value emphasizes the importance of the human element in software development, advocating for direct communication, collaboration, and the flexibility to adapt to change over strict adherence to rigid processes or reliance on specific tools. It recognizes that while processes and tools are important, they should serve the team and the individuals within it, rather than the other way around.

References:
The Agile Manifesto itself, along with various interpretations and guides such as those
provided by Smartsheet1.and LogRocket2, support this value as one of the central tenets of Agile methodologies. These resources offer insights into how this value, along with the other three, guide the Agile approach to efficient and effective software development.

Data flow analysis traces how data enters the system, how it is processed, and where it is stored or output.
This technique helps identify vulnerabilities related to improper validation, insecure storage, or unintended data exposure.

To combat identity spoofing threats, a mitigation technique that is often used is requiring user authorization. This involves implementing strong authentication methods to verify the identity of users before granting access to sensitive information or systems. Techniques such as two-factor authentication (2FA) or multi-factor authentication (MFA) are effective in reducing the risk of unauthorized access, as they require users to provide multiple pieces of evidence to confirm their identity, making it much harder for attackers to spoof an identity successfully.
Best practices for preventing spoofing attacks, including the use of antivirus and firewall tools, and the importance of strong authentication methods like 2FA and MFA1.
The National Security Agency's guidance on identity theft threats and mitigations, emphasizing the need for personal protection and strong authentication measures.
Discussion on the effectiveness of strong authentication methods in protecting against spoofing attacks.
The role of comprehensive identity verification and authentication strategies in preventing AI-enhanced identity fraud 4.

The activity described pertains to the review of noncommercial software libraries to ensure compliance with the legal specifications set by the authors. This is part of the open-source licensing review, which is a critical activity in the Ship phase of the Security Development Lifecycle (SDL). This review ensures that all open-source components are used in accordance with their licenses, which is essential for legal and security compliance. The Ship phase of the SDL includes various activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensing review, and final security and privacy reviews12.The open-source licensing review specifically addresses the legal aspects of using
third-party software components.

Dynamic analysis evaluates an application while it is running. The tester interacts with the executable and observes behavior such as crashes, exceptions, or unexpected responses. Unlike static analysis or manual code review, dynamic analysis does not require access to source code and focuses on runtime behavior.