8. Software Development Security Flashcards
Which IP protocol is secure and how?
IPv6 is inherently secure, as it uses IP Sec. IP Sec is a framework for traffic including the support for encryption, authentication, authorization and integrity.
What are the software development methodologies?
- Waterfall
- Prototyping
- Spiral
- Agile
Define Waterfall
Software development methodology.
Phase based approach. Best for small projects
Pros: define before code
Cons: adjusting scope during project can kill it.
Define Prototyping
A software development methodology.
A cyclical approach to development. Makes a working model and expand off of it to fit what customer wants.
Pros: users interact with model and give feedback
Cons: tendency for superficial analysis
Define Spiral
A software development methodology
Combo of waterfall and prototyping. Good for large projects.
Pros: a usable software is produced early in the cycle.
Cons: costly. Risk analysis requires highly specific expertise.
Define Agile
A software development methodology
Current popular model. Have new objective every ~2 weeks
Pros: fewer defects, greater flexibility instant feedback.
Cons: less documentation, less focus on system design. Harder to track.
Define distributed computing
An architecture style.
- Client-server. Ie. thin/fat clients.
- Peer-to-peer. Ie. file sharing systems.
Define Service Orientated Architecture
An architecture and a vision on how heterogeneous applications should be developed and integrated into the enterprise.
Share a formal contract.
Reusable, autonomous, stateless, discoverable.
Define Rich Internet Applications
An architecture style.
Web applications
What are main threats of rich internet applications?
client side: XSS and CSRF
Server side: code injection and aggregation
What is polyinstatiation?
Lying.
What is aggregation?
Collecting of information.
Define ubiquitous computing.
Wireless networking.
Ie. RFID, NFC, and LBS (location based services)
Define monitoring
Validation of compliance to regulations and other governance requirements.
Demonstrates due diligence and due care on the part of the organization towards its shareholders.
What are the characteristics of good metrics?
Consistency Quantitative Objectivity Relevance Inexpensive
Define auditing
Important detective controls that can be used to correlate information after an event.
Used to ensure policies are being followed and are effective.
What is Code injection?
An OWASP Vulnerability
Injection flaws in code that occur when untrusted data is sent to an interpreter as part of a command or quart.
What is Broken Authentication & Session Management?
An OWASP Vulnerability
Application functions related to authentication that are not implemented correctly and allow attackers to compromise information to assume others identities.
What is XSS?
An OWASP Vulnerability
Cross Site Scripting
Whenever an application takes untrusted data and sends it to a web browser without proper validation.
What is Insecure Direct Object References?
An OWASP Vulnerability
Unauthorized user or process which can invoke the internal functionality of the software by manipulating parameters and other object values.
What are security misconfigurations?
An OWASP Vulnerability
When a configuration is not set to its secure settings.
What is Sensitive Data Exposure?
An OWASP Vulnerability
When web applications do not adequately protect sensitive data.
Ie. Insufficient protection for data-at-rest, data-in-transit, or data-in-use.
What is missing function level access control?
An OWASP Vulnerability
When a web app does not reverify the access rights with each new function accessed.
What is CSRF?
An OWASP Vulnerability
Forcing a logged-on victims browser to send a forged HTTP request, including cookies and authentication information.
What is Known Vulnerability Component Usage?
An OWASP Vulnerability
Using deprecated, insecure, or banned APIs. These can undermine the security of other applications.
What are Unvalidated Redirects and Forwards?
An OWASP Vulnerability
When web apps redirect or forward a user to other pages and use untrusted data to determine the destination pages.
What is defensive coding?
A form of proactive, secure coding intended to ensure the continued function of the software under unforeseen circumstances.
What are the first 5 secure coding practices?
- Input validation
- Data sanitization
- Error handling
- Safe APIs
- Concurrency
What are the last 5 secure coding practices?
- Tokenizing
- Sand boxing
- Anti-tampering
- Secure processes for software
- Secure builds
What are the 3 secure processes for software?
- Version control
- Code analysis
- Code review
What is concurrency?
Simultaneous operations.
Should be avoided to help avoid race conditions, and keep single threaded operations.
What is tokenizing?
Replacing sensitive data with a token that still retains the needed information about the data.
What is included in change management?
Parts include: procedural, scheduling, documentation, training, fall backs, change management database, support info.
What is patch management?
Additional pieces of code developed to address problems in software, and their management in a secure environment.
What is fuzzing?
Fault injection testing
Brute force type of testing in which faults are injected into the software and behavior is observed.
Validated the effectiveness of input validation.
What is verification?
The technical design of the product.
Does it meet the developers description?
What is validation?
Does the product solve the problem I have?
Does it solve the problem it is supposed to solve?
What is accreditation?
Managements acceptance of the product and their decision to implement the software in their environment.
What are the database models?
- Hierarchical
- Distributed
- Object-oriented
- Relational
What are object-orientated databases?
Databases that keep track of objects and entities that contain both data and action of the data.
What are hierarchical databases?
Stores related information in a tree like fashion.
What are distributed databases?
Client-Server type of database located on more then one server in more then on location.
What are relational databases?
A database in the form of tables related to each other.
Stores data in such a way that a data manipulation language can be used independently on data.
What is a primary key?
A part of relational databases.
A unique identifier for each record.
What is normalization?
A part of relational databases.
The process of removing duplicates and ensuring that each attribute only describes the primary key.
What is a Tuple?
A part of relational databases.
A group of attributes about a single instance.
What are foreign keys?
A part of relational databases.
Primary keys from other tables, listed on a new table with a different primary key. Used to relate tables.
What is a record or column?
A part of relational databases.
A group of attributes about a single instance. Like a tuple.
What is a schema?
A part of relational databases.
The whole idea for how the database functions and is set up.
