Which of the following is MOST helpful to significantly reduce application risk throughout the system...

ImplementingSecurity by Designthroughout theSoftware Development Life Cycle (SDLC)is the most effective way toreduce application riskbecause:

Proactive Risk Mitigation:Incorporates security practices from the very beginning, rather than addressing issues post-deployment.

Integrated Testing:Security requirements and testing are embedded in each phase of the SDLC.

Secure Coding Practices:Reduces vulnerabilities likeinjection, XSS, and insecure deserialization.

Cost Efficiency:Fixing issues during design is significantly cheaper than patching after production.

Other options analysis:

B. Security through obscurity:Ineffective as a standalone approach.

C. Peer code reviews:Valuable but limited if security is not considered from the start.

D. Extensive penetration testing:Detects vulnerabilities post-development, but cannot fix flawed architecture.

CCOA Official Review Manual, 1st Edition References:

Chapter 10: Secure Software Development Practices:Discusses the importance of integrating security from the design phase.

Chapter 7: Application Security Testing:Highlights proactive security in development.