🛡 Testing & Evaluating Software Security

📚 Syllabus Dot Point

Test and evaluate the security and resilience of software by determining vulnerabilities, hardening systems, handling breaches, maintaining business continuity and conducting disaster recovery

Imagine you have built an app. You have encrypted the database, hashed the passwords, set up two-factor authentication. You think it is secure. But how do you know? How do you know there is not a hidden weakness a hacker could exploit? And what happens if, despite all your protections, someone does get in?

This is what this topic is about. It covers five connected ideas:

1. Determining vulnerabilities means actively searching for weaknesses in your software before an attacker finds them. Think of it like a building inspector checking a house for structural problems before anyone moves in.

2. Hardening systems means fixing those weaknesses and adding extra layers of protection. Like reinforcing the walls, adding deadlocks to the doors, and installing a security alarm.

3. Handling breaches means having a clear plan for what to do when (not if) an attack succeeds. Like a fire evacuation plan — you hope you never need it, but if a fire starts, everyone needs to know exactly what to do.

4. Business continuity means keeping the business running even while dealing with a crisis. If a hospital is hit by ransomware, patients still need treatment. The hospital cannot just shut down.

5. Disaster recovery means getting everything back to normal after the crisis is over. Restoring data from backups, rebuilding compromised systems, and making sure it cannot happen again.