9.2. Application Security Testing
💡 First Principle: Secure software does not emerge from ad-hoc development — it requires deliberate design patterns that assume failure, limit trust, and reduce the blast radius when something goes wrong. The secure coding principles that follow are not stylistic preferences; each addresses a specific class of vulnerability or limits the damage when a vulnerability is exploited.
Security assessment of software requires understanding both what the software does and how it does it. Application security testing methods (SAST, DAST, IAST, manual review) are most effective when guided by a threat model that identifies which components handle sensitive data, which trust boundaries exist, and which attack surfaces are most exposed.
Why this matters: Secure coding principles appear in scenario questions asking "which design decision improves security?" and assessment method questions asking "which testing approach best finds this specific vulnerability class?" Both require understanding the principle behind the control, not just its name.
