Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > 8. Software Development Security > Flashcards

8. Software Development Security Flashcards

1
Q

Which IP protocol is secure and how?

A

IPv6 is inherently secure, as it uses IP Sec. IP Sec is a framework for traffic including the support for encryption, authentication, authorization and integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the software development methodologies?

A
  1. Waterfall
  2. Prototyping
  3. Spiral
  4. Agile
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define Waterfall

A

Software development methodology.

Phase based approach. Best for small projects

Pros: define before code
Cons: adjusting scope during project can kill it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define Prototyping

A

A software development methodology.

A cyclical approach to development. Makes a working model and expand off of it to fit what customer wants.

Pros: users interact with model and give feedback

Cons: tendency for superficial analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define Spiral

A

A software development methodology

Combo of waterfall and prototyping. Good for large projects.

Pros: a usable software is produced early in the cycle.

Cons: costly. Risk analysis requires highly specific expertise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Agile

A

A software development methodology

Current popular model. Have new objective every ~2 weeks

Pros: fewer defects, greater flexibility instant feedback.

Cons: less documentation, less focus on system design. Harder to track.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define distributed computing

A

An architecture style.

  1. Client-server. Ie. thin/fat clients.
  2. Peer-to-peer. Ie. file sharing systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define Service Orientated Architecture

A

An architecture and a vision on how heterogeneous applications should be developed and integrated into the enterprise.

Share a formal contract.

Reusable, autonomous, stateless, discoverable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define Rich Internet Applications

A

An architecture style.

Web applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are main threats of rich internet applications?

A

client side: XSS and CSRF

Server side: code injection and aggregation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is polyinstatiation?

A

Lying.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is aggregation?

A

Collecting of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define ubiquitous computing.

A

Wireless networking.

Ie. RFID, NFC, and LBS (location based services)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define monitoring

A

Validation of compliance to regulations and other governance requirements.

Demonstrates due diligence and due care on the part of the organization towards its shareholders.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the characteristics of good metrics?

A 
Consistency
Quantitative 
Objectivity 
Relevance
Inexpensive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define auditing

A

Important detective controls that can be used to correlate information after an event.

Used to ensure policies are being followed and are effective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Code injection?

A

An OWASP Vulnerability

Injection flaws in code that occur when untrusted data is sent to an interpreter as part of a command or quart.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Broken Authentication & Session Management?

A

An OWASP Vulnerability
Application functions related to authentication that are not implemented correctly and allow attackers to compromise information to assume others identities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is XSS?

A

An OWASP Vulnerability
Cross Site Scripting
Whenever an application takes untrusted data and sends it to a web browser without proper validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Insecure Direct Object References?

A

An OWASP Vulnerability
Unauthorized user or process which can invoke the internal functionality of the software by manipulating parameters and other object values.

21
Q

What are security misconfigurations?

A

An OWASP Vulnerability

When a configuration is not set to its secure settings.

22
Q

What is Sensitive Data Exposure?

A

An OWASP Vulnerability
When web applications do not adequately protect sensitive data.

Ie. Insufficient protection for data-at-rest, data-in-transit, or data-in-use.

23
Q

What is missing function level access control?

A

An OWASP Vulnerability

When a web app does not reverify the access rights with each new function accessed.

24
Q

What is CSRF?

A

An OWASP Vulnerability

Forcing a logged-on victims browser to send a forged HTTP request, including cookies and authentication information.

25
Q

What is Known Vulnerability Component Usage?

A

An OWASP Vulnerability

Using deprecated, insecure, or banned APIs. These can undermine the security of other applications.

26
Q

What are Unvalidated Redirects and Forwards?

A

An OWASP Vulnerability

When web apps redirect or forward a user to other pages and use untrusted data to determine the destination pages.

27
Q

What is defensive coding?

A

A form of proactive, secure coding intended to ensure the continued function of the software under unforeseen circumstances.

28
Q

What are the first 5 secure coding practices?

A
  1. Input validation
  2. Data sanitization
  3. Error handling
  4. Safe APIs
  5. Concurrency
29
Q

What are the last 5 secure coding practices?

A
  1. Tokenizing
  2. Sand boxing
  3. Anti-tampering
  4. Secure processes for software
  5. Secure builds
30
Q

What are the 3 secure processes for software?

A
  1. Version control
  2. Code analysis
  3. Code review
31
Q

What is concurrency?

A

Simultaneous operations.

Should be avoided to help avoid race conditions, and keep single threaded operations.

32
Q

What is tokenizing?

A

Replacing sensitive data with a token that still retains the needed information about the data.

33
Q

What is included in change management?

A

Parts include: procedural, scheduling, documentation, training, fall backs, change management database, support info.

34
Q

What is patch management?

A

Additional pieces of code developed to address problems in software, and their management in a secure environment.

35
Q

What is fuzzing?

A

Fault injection testing
Brute force type of testing in which faults are injected into the software and behavior is observed.

Validated the effectiveness of input validation.

36
Q

What is verification?

A

The technical design of the product.

Does it meet the developers description?

37
Q

What is validation?

A

Does the product solve the problem I have?

Does it solve the problem it is supposed to solve?

38
Q

What is accreditation?

A

Managements acceptance of the product and their decision to implement the software in their environment.

39
Q

What are the database models?

A
  1. Hierarchical
  2. Distributed
  3. Object-oriented
  4. Relational
40
Q

What are object-orientated databases?

A

Databases that keep track of objects and entities that contain both data and action of the data.

41
Q

What are hierarchical databases?

A

Stores related information in a tree like fashion.

42
Q

What are distributed databases?

A

Client-Server type of database located on more then one server in more then on location.

43
Q

What are relational databases?

A

A database in the form of tables related to each other.

Stores data in such a way that a data manipulation language can be used independently on data.

44
Q

What is a primary key?

A

A part of relational databases.

A unique identifier for each record.

45
Q

What is normalization?

A

A part of relational databases.

The process of removing duplicates and ensuring that each attribute only describes the primary key.

46
Q

What is a Tuple?

A

A part of relational databases.

A group of attributes about a single instance.

47
Q

What are foreign keys?

A

A part of relational databases.

Primary keys from other tables, listed on a new table with a different primary key. Used to relate tables.

48
Q

What is a record or column?

A

A part of relational databases.

A group of attributes about a single instance. Like a tuple.

49
Q

What is a schema?

A

A part of relational databases.

The whole idea for how the database functions and is set up.

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions