SPREN1 Logs

Senior management decides and provides resources; the Chief Product Security Officer owns strategy and policy; product security officers support projects and assessments; architects define security architectures; analysts (often a PSIRT) handle vulnerabilities and disclosure; sec...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

Password manager and smart door lock: Important class I. Hypervisor and firewall: Important class II. HSM: Critical. Smart refrigerator: Default. Default: a connected fridge or toaster, a consumer game, educational software. Nothing in them is a security function, so self-assess...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

Make sure the architecture fulfils the relevant security quality attributes and that the security controls are designed properly in detail. The Architect is responsible. Inputs are the high-level system architecture, the product security requirements and the threat model. Securi...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

A list of the most relevant security risks for applications built on large language models, from the OWASP GenAI Security Project (maintained since 2023, current list on genai.owasp.org). Prompt injection is number one. Prompt injection: input that changes the model's instructio...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

Plan: test plan, test cases, hardening spec, release policies. Code: linter or IDE checks, unit tests, SCA. Build: SAST, compiler flags, package updates, hardening. Test: DAST, integration tests. Release: pentest, approval for prod. Deploy: update the configuration database, set...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

IT protects the confidentiality, integrity and availability of information. OT protects the safety, reliability and availability of physical processes. Because OT downtime can endanger people or equipment, OT tolerates almost no downtime and is updated with great caution. * IT p...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

A process standard says how to develop securely (activities, roles, lifecycle), for example IEC 62443-4-1, ISO/SAE 21434 or Microsoft SDL. A control standard says which security measures the product must have, for example IEC 62443-4-2, ETSI EN 303 645 or FIPS 140-3. Process s...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

R&D leadership, product owners, project leaders, architects and developers, testing (V&V), quality and GRC, legal, IT, production management and customer support. Each one owns part of the lifecycle. R&D leadership: priorities, budget and the secure development process. Product...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

They grade how strong an attacker a component must withstand, from no protection (SL 0) up to a sophisticated, well-resourced, highly motivated attacker with IACS-specific knowledge (SL 4). They are used to tailor the IEC 62443-4-2 component controls. * Each security level is de...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

Decomposition lists every component and sub-component (the basis for the configuration inventory, classification and vulnerability management). Deployment view shows components and interfaces for threat modelling and mitigation planning. Data flow diagrams trace individual data i...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026