WGU Courses and Certificates Secure-Software-Design Question # 13 Topic 2 Discussion

Penetration testing is an activity where a simulated attack is performed on a software product to identify vulnerabilities that could be exploited by attackers. It is a proactive and authorized attempt to evaluate the security of an IT infrastructure by safely trying to exploit system vulnerabilities, including OS, service and application flaws, improper configurations, and risky end-user behavior. In the context of the Ship phase of the Security Development Lifecycle (SDL), penetration testing is conducted as a final check to uncover any potential security issues that might have been missed during previous phases. This ensures that the software product is robust and secure before it is released.

References:

The Ship phase of the SDL includes activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensing review, and final security and privacy reviews1.

Penetration testing is a critical component of the Ship phase, as it helps to identify and fix security vulnerabilities before the software is deployed2.