Ideas for belt activities

[mvollmary]

unknown belt

• Protection Poker
• Test for weak passwords
• Identify and remove unused software
• Advanced Unit Tests for Security Features
  • Testing for Vulnerable Remember Password
    • OWASP 4.4.5
• Conduction of build-it, break-it, fix-it contests (after blue belt)
• Port Scan
• Denial of Service Tests / Brute Force Tests
• Do you analyze log data for security incidents periodically?
• Collect Metrics from tools/tests/checks within CI/CD Pipeline
  • include results and suppressions
• Restrict access to PROD environments

yellow belt

• Within Unit Tests for Security Features
  • Mention OWASP 4.4.3

orange belt

• "good" TLS everywhere
  • tools: Burp, ZAP, Portscan, testssl, sslyze, sslscan
  • 4.4.1 Testing for Credentials Transported over an Encrypted Channel