4 - Secure Software Design Flashcards

1
Q

Attack Vectors

A

a way for attackers to enter a network or system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

MQTT Backend vulnerability

A

It did not require authentication so hackers could get in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ABB ChargerSync vulnerability

A

Bypass of PIN Code Provisioning.
File Access and Data leakage
- Unauthenticated OCPP Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Security By Design

A

Anticipating malicious behaviour and attacks during the design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Dev Life: Requirement Analysis (1)

A

Find the info to be stored and if it is going to be protected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Dev Life: Design (2)

A

Consider access control and lock down each entry point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Dev Life: Implementation (3)

A

Set up any new HW or SQ as well as coding new SW.

  • Stop gathering requirements and practice secure coding
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Dev Life: TEsting (4)

A

Test the security of your app using correct, incorrect and malicious inputs/actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Dev Life: Install and maintain (5/6)

A

Think about upgrades and software end of life etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How to prevent password cracking?

A
  • Enforce strong passwords
  • Force password changes
  • Change default passwords
  • Stronger auth methods. Certs, challenge/response, smartcard
  • Monitor and track password attacks, lock the account after number of attemps
  • Rename root, admin etc and protect
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

functions in stack memory

A
  1. return address, stack frame pointer and variables are added to stack
  2. return address has a higher address in the buffer

During the buffer overflow the return address is overwritten

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Shellcode with buffer overflow

A

Hacker would want to overwrie data with shellcode with a return address pointing to the start of it - the payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Buffer overflow protections

A
  • Choice of programming languages
  • Buffer overflow protection (detect them)
  • Address space layout randomisation (randomly arrange locations in mem)
    = Executable space protection (mark mem as non-executable)
  • Bounds Checking (check variable size)
  • Static code analysis (code scans)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Shellcode

A

Injected code in buffer overflow which can achieve goal for hacker.H

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Heartbleed attack

NOT APACHE

A

Affected OpenSSL (via TLS)

Overread. Hackers could read more data than intended by asking for a return value longer than the test message they sent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

XSS Cross Site Scripting

A

Attacker injects malicious code into web pages to gain info.

PHP, JS, VBScript etc

17
Q

Defence measures for software design

A
  • Consider security in design/requirements
  • Secure coding
  • Secure environment (OS, network, database)
18
Q

Secure coding best practices

A
  • Conventions
  • Safe functions only
  • Code analysis
  • Data handled safely
  • Handle errors
  • Manage security risk inherent in the use of 3rd party components
  • Testing and validation