Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Software Assurance > Chapter 1 > Flashcards

Chapter 1 Flashcards

1
Q

Operational security of software-intensive systems depends on the practices and techniques during their

A

design and development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Lifecycle processes must consider the _______ inherent in the operational environments where systems are deployed

A

security- related

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Increased consideration of operational security earlier in the acquisition and development process provides an opportunity to _____________

A

tone decisions to address security risk and reduce the total cost of operational security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SCADA stands for

A

supervisory control and data acquisition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Much of the information protection in place today is based on the principles established by _______

A

Saltzer and Schroeder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Where and when did Saltzer and Schroeder’s publication appear?

A

1974, Communications of the ACM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What was the title of Saltzer and Schroeder’s influential paper?

A

“The Protection of Information in Computer Systems”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What did Saltzer and Schroeder define as security?

A

“Techniques that control who may use or modify the computer or the information contained in it.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the three main categories of security concern?

A

Confidentiality, integrity, availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Name some examples of security problems

A

Malware, viruses, XSS, SQL Injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Those working with deployed systems refer to their enhanced security needs as _____

A

Cyber Security Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Software assurance as a term usually refers to the areas of ______

A

acquisition and development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the NASA definition of software assurance?

A

“The planned and systematic set of activities that ensure that software lifecycle processes and products conform to requirements, standards, and procedures.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What ISO standards are a good reference for software assurance topics?

A

ISO/IEC 2008a, 2008b, 2009, 2011, 2015

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What do definitions of software assurance usually include?

A

The requirement that software functions as intended.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What’s one reason for the different approaches suggested by the existing definitions of software assurance?

A

Risks related to modern systems of systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are some other challenges to effective operational security?

A

The increased use of commercial off-the-shelf (COTS) and open-source software as components within a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sustainment is

A

maintaining a deployed system over time as technology and operational needs change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Ignoring the issues surrounding sustainment can _______

A

undermine the stability, security and longevity of systems in production

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Economy of mechanism

A

Keep the design as simple and small as possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Fail-safe defaults

A

base access decisions on permission rather than exclusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

complete mediation

A

every access to every object must be checked for authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

open design

A

the design should not be secret. the mechanisms should not depend on the ignorance of the potential attackers, rather on the possession of specific and more easily protected keys and passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

separation of privilege

A

where feasible, a protection mechanism that requires 2 keys to unlock is more robust and flexible than one that allows access to the presenter of only a single key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

least privilege

A

every program and every user of the system should operate using the least set of privileges necessary to complete the job.

26
Q

least common mechanism

A

minimize the amount of mechanism common to more than one user and depended on by all users

27
Q

psychological acceptability

A

it is essential that the human interface be designed for ease of use so that users routinely and automatically apply the protection mechanisms correctly

28
Q

a ______ of risk drives assurance decisions

A

perception

29
Q

organizations without effective software assurance programs perceive risks based on ______

A

successful attacks and usually respond reactively

30
Q

organizations can incorrectly perceive risk when they don’t ________

A

understand the threats and their impacts

31
Q

risk concerns shall be _______ across all stakeholders and all interconnected technology elements

A

aligned

32
Q

highly connected systems require _________

A

the aligning of risk across all stakeholders

33
Q

protections can be applied at every technology _____

A

level

34
Q

protections will conflict if not _____________

A

well orchestrated

35
Q

dependencies shall not be trusted until proven _______

A

trustworthy

36
Q

assurance of an integrated product depends on _________

A

other people’s assurance decisions

37
Q

organizations must decide how much trust to place in dependencies based on _______

A

realistic assessments of the threats, impacts and opportunities represented by various interactions

38
Q

dependencies are not _____

A

static

39
Q

organizations must regularly review ______

A

trust relationships

40
Q

attacks shall be _____

A

expected

41
Q

a ________ of attackers can compromise an organization’s technology assets

A

broad community

42
Q

there are no ______ protections against attacks

A

perfect

43
Q

the attacker profile is _______

A

constantly changing

44
Q

assurance requires effective ______ among all technology participants

A

coordination

45
Q

organizations must apply protection broadly across its ________

A

people, policies and technologies

46
Q

attackers take advantage of ______

A

all possible entry points

47
Q

clearly establish ______ and _____

A

authority and responsibilityA

48
Q

assurance shall be _______ and ______

A

well planned and dynamic

49
Q

assurance must represent a balance between _____, _____, and ______

A

governance, construction and operation

50
Q

a means to measure and audit overall assurance shall be _______

A

built in

51
Q

organizations cannot manage what they cannot ______

A

measure

52
Q

users will not address issues unless ______

A

held accountable

53
Q

organizations must take focused measures to ensure that components are

A

securely engineered

54
Q

operational systems are built and acquired through coordinated actions involving predefined steps. This is known as a _____

A

lifecycle

55
Q

what standards provide guidance for suitable lifecycles?

A

NIST SP-800-160, ISO 15288

56
Q

Every component of the software system and its interfaces must be operated and sustained with ________ in mind

A

organizational risk

57
Q

confidence is a quality measure that means what?

A

the delivered system will behave as specified

58
Q

At the start of the development cycle, the confidence gap is ______

A

large

59
Q

reliability depends on

A

identifying and mitigating potential faults

60
Q

how can assurance be defined?

A

“a documented body of evidence that provides a convincing and valid argument that a specific set of critical claims about a system’s properties are adequately justified for a given application in a given environment.” (Kelly 1998)

61
Q

Assurance reviewers may doubt the _______, ________, and _______

A

claim, argument, evidence

62
Q
A

Software Assurance (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions