Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CAS-003 > 2.4 Software Vulnerabilities > Flashcards

2.4 Software Vulnerabilities Flashcards

Given software vulnerability scenarios, select appropriate security controls

1
Q

(Application Security Design Considerations)

Secure by Design

A

an application has considered the threat environment it will be operating within and that it appropriately uses available technology to achieve security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

(Application Security Design Considerations)

Secure by default

A

the principle that when an application is deployed in a default configuration, security is maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

(Application Security Design Considerations)

Default by deployment

A

an application is deployed into an environment that will support the security goals of the application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

(Specific Application Issues)

Unsecure direct objective references

A

a direct object occurs when an application refers to the actual name of objects such as files, folders, databases, or storage elements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

(Specific Application Issues)

XSS

A

Cross site scripting
-involves attackers discovering and exploiting vulnerabilities on websites in order to inject malicious code-typically JavaScript

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

(Specific Application Issues)

CSRF

A

Cross-Site request forgery
-malicious code found in emails, websites, or instant messages and cause a user’s WEB BROWSER to execute undesired actions on a site to which the user is already authenticated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

(Specific Application Issues)

Click-Jacking

A

an attack where a use is tricked into clicking something on a web page causing a different operation to be performed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

(Specific Application Issues)

Session Management

A

Session management is done through the use of cookies and session IDs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

(Specific Application Issues)

Input Validation

A

Screening all input to ensure it is in proper form and length before processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

(Specific Application Issues)

SQL injection

A

designed to attack the database associated with a web application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

(Specific Application Issues)

Improper error and exception handling

A

occurs when an error message provides too much information to the attacker, thus revealing vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

(Specific Application Issues)

Fuzzing/fault injection

A

a software testing methodology used to detect input validation errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

(Specific Application Issues)

Secure cookie storage and transmission

A

cookies provide client-managed storage in the form of text files that enable a web browse to locally store information from a web application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

(Specific Application Issues)

Buffer overflow

A

when the size of the data being read is larger than the destination buffer causing an overflow condition resulting in application failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

(Specific Application Issues)

Memory leaks

A

result in failure of an application to correctly manage memory, which can lead to a memory shortage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

(Specific Application Issues)

Integer overflows

A

error that occurs when a number is too large to be stored in the variable

17
Q

(Specific Application Issues)

Race Condition

A

software flaws that arise from different processes or threads having a dependence on an object or resource that affects another thread or process

18
Q

(Specific Application Issues)

Resource Exhaustion

A

a form of DoS where a required resource to perform some specific action is not available at the time of need

19
Q

(Specific Application Issues)

Geotagging

A

attaching geographical identification properties to media such as pictures,websites, videos etc

20
Q

(Specific Application Issues)

Use of third party libraries

A

helps reduce development time and improves code quality and security

21
Q

(Specific Application Issues)

Data remnants

A

any unwanted pieces of information that remain after a deletion operation

22
Q

(Specific Application Issues)

Code reuse

A

the authorized use of someone else’s proven code, to improve your software development efforts

23
Q

Application Sandboxing

A

a mechanism to constrain an application into a confined area during execution

24
Q

Secure encrypted enclaves

A

secure enclaves use a separate coprocessor from the system’s main processor to prevent the main processor from having direct access to information stored in the secure encrypted enclave

25
Q

Database activity monitor

A

independently monitor the transactions and other activity of database services
-monitors applications and uses for unauthorized or fraudulent activity such as SQL injection attacks

26
Q

Web application firewalls

A

firewalls created for web apps to impart HTTP-specific rules to guard against attacks such as XSS, session hijacking, SQL injection

27
Q

Client-Side processing Vs. Server-side processing

A
  • Client-side processing is faster than a round-trip to the server
  • Server-side processing acts as the real input validation, preventing any input overflow or canonicalization errors
28
Q

(Client-Side processing Vs. Server-side processing)

JSON

A

SavaScript Object Notation
- language-independent format derived from JavaScript that utilizes simple text format for the storage and exchange of data between a browser and web application

29
Q

(Client-Side processing Vs. Server-side processing)

REST

A

Representational State Transfer
-framework that relies on various web protocols to define how clients and servers can exchange web resources with a high degree of interoperability

30
Q

(Client-Side processing Vs. Server-side processing)

Browser extensions

A

known add-ins or plugins, are tiny programs connected to a web browser to provide extra functionality

31
Q

(Client-Side processing Vs. Server-side processing)

ActiveX

A

microsoft software framework designed for internet explorer for the purpose of running dynamic media content
-built on object oriented programming technologies

32
Q

(Client-Side processing Vs. Server-side processing)

Java applets

A

small platform-independent and internet-based programs accessible within a web browser

33
Q

(Client-Side processing Vs. Server-side processing)

HTML5

A

fifth generation of HTML markup language

  • used for describing the contents and appearance of web pages
  • enhanced to support more multimedia capabilities , added mobile device support, plus many other features
34
Q

(Client-Side processing Vs. Server-side processing)

AJAX

A

Asynchronous JavaScript and XML

-common programming methodology used to improve the end-user web applications

35
Q

(Client-Side processing Vs. Server-side processing)

SOAP

A

a specification for exchanging information associated with web services

36
Q

(Client-Side processing Vs. Server-side processing)

State Management

A

states can be managed in a variety of manners, but the two primary means are both via cookies, with the state being maintained either in the cookie or on the server via a lookup process

37
Q

(Client-Side processing Vs. Server-side processing)

JavaScript

A

scripting language developed by netscape and designed to be operating within a browser instance

38
Q

Operating system vulnerabilities

A

can include unnecessary services, lack of encryption, lack or hardening, open ports, and missing patches

39
Q

Firmware vulnerabilities

A

result in serious security issues

CAS-003 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions