Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSSLP > Chapter 4 - Secure Software Implementation/Coding > Flashcards

Chapter 4 - Secure Software Implementation/Coding Flashcards

1
Q

What is the most important skill a programmer has?

A

Problem solving.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a CPU composed of?

A

ALU, control unit, registers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the ALU

A

Arithmetic Logic Unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the main component a CPU communicates with?

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the system bus?

A

The gateway channel between which the components of a system communicates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the sequence of executing one instruction?

A
  • Fetching (get the instruction from memory)
  • Decoding: Deciphers the instruction and moves data from memory to the ALU
  • Execution: ALU performs mathematical or logical operation on the data
  • Storing: ALU stores the result in memory or register
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe the interal memory layout of a program.

A
  • program text
  • data
  • stack
  • heap
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the text segement of a program?

A

The instruction code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the data segment of a program?

A

The area in memory that contains global data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the ESP?

A

The Execution Stack Pointer (I think this is wrong and it should be Extended, a remnant of 16->32 bit) Yeah, this is wrong.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a VHLL?

A

Very High Level Language. These are almost like English.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is another name for machine code?

A

Native code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is another name for native code?

A

Machine code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a compiled language?

A

Code that is converted from source code to object code, then linked with other modules and/or libraries into machine code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is complilation and what does it produce?

A

Compilation: The process of converting textual source code written by the programmer into raw processor specific instruction codes. The output of the compilation process is called the object code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is linking?

A

Duh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the benefits of static linking?

A

Faster processing speed and ease of portability because dependencies are included.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the disadvantages of static linking?

A

Larger executables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a security risk of using dynamic libraries?

A

If someone compromises a library, they can effective compromise all binaries that use it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is an interpreted language?

A

One that requires an intermediary host program to read and execute each statement of instruction line by line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

List common interpreted language.

A

REXX, PostScript, Perl, Ruby, Python.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Disadvantages of interpreted languages?

A

Slower, quicker to change, no recompilation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are hybrid languages?

A

the source code is compiled into an intermediate stage that resembles object code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an example of a Hybrid Language?

A

Java and .Net

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the typical SDLC models?

A
  • Waterfall
  • Iterative
  • Spiral
  • Agile
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the Waterfall Model

A
  1. Requirements specification
  2. Design
  3. Construction (also known as implementation or coding)
  4. Integration
  5. Testing and debugging (also known as verification)
  6. Installation
  7. Maintenance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the 5 phases of the Waterfall model according to NIST 800-64?

A
  • Initiation
  • Acquisition/development
  • Implementation/assessment
  • Operations/maintenance
  • Sunset
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the defining characteristic of Waterfall?

A

the unidirectional sequential phased approach to software development.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the Iterative Model?

A

the project is broken into smaller versions and developed incrementally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Synonym for the Iterative Model?

A

Prototyping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the advantage of the Iterative Model?

A

Increased user input opportunity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the disadvantage of Iterative?

A

If planning cycles are too short, nonfunctional requirements like security get missed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the Spiral Model?

A

The key characteristic of this model is that each phase has a risk assessment review activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the primary benefit of Agile?

A

changes can be made quickly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the two agile development methodologies?

A

XP and Scrum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is XP

A

Extreme Programming.

People centric. Small projects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is Scrum?

A

An Agile variant that uses short (30 day) release cycles to allow requirements to change on the fly.

Daily progress recorded on a burn down chart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What 3 categories do the 2009 CWE/SANS Top 25 programming errors fall into?

A
  • Insecure interaction between components
  • Risky resource management
  • Porous defenses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Describe Injection Flaws

A

User supplied data is not validated before being processed.

40
Q

What is SQL Injection?

A

An attacker supplying input that becomes part of a database query.

41
Q

What is one way of thwarting SQL Injection?

A

Suppress database errors, which are used for reconnaissance.

42
Q

What is blind SQL injection?

A

SQL injection using boolean SQL expressions to probe a target database.

43
Q

What is OS command injection?

A

Just like SQL injection.

44
Q

What is LDAP injection

A

Same principle as SQL and OS. Unsanitized input is used to construct or modify syntax, contents, and commands that are executed as an LDAP query.

45
Q

What is XML Injection?

A

XML injection occurs when the software does not properly filter or quote special characters or reserved words that are used in XML, allowing an attacker to modify the syntax, contents, or commands before execution.

46
Q

Whati is XPATH injection?

A

the XPath expression used to retrieve data from the XML data store is not validated or sanitized before processing and built dynamically using user-supplied input.

47
Q

What is XQuery Injection?

A

XQuery injection works the same way as an XPath injection, except that the XQuery (not XPath) expression used to retrieve data from the XML data store is not validated or sanitized before processing and built dynamically using user-supplied input.

48
Q

What are the common traits for any injection attack?

A
  • User-supplied input is interpreted as a command or part of a command that is executed.
  • Input from the user is not sanitized or validated before processing
  • The query that is constructed is generated using user-supplied input dynamically.
49
Q

How can you prevent injection flaws?

A

See Injection Flaws Controls. You mostly know all this.

50
Q

What is cross-site scripting?

A

user-supplied input is sent back to the browser client without being properly validated and its content escaped

51
Q

What are the types of XSS?

A
  • Nonpersistent - user supplied input script is merely included in the response from the web server
  • Persistent/stored - the injected script is permanently stored on the target servers, in a database, a message forum, a visitor log, or an input field
  • DOM-based - the payload is executed in the victim’s browser as a result of DOM environment modifications on the client side.
52
Q

What is the consequence of a XSS attack?

A

Attackers execute code on the user’s browser, causing all the usual badness that entails.

53
Q

How do you prevent XSS?

A
  • Escaping or encoding
  • Validating user supplied input with a whitelist
  • Disallow uploading .htm or .html extensions
  • Use innerText, not innerHtml (makes it non-executable)
  • Use secure libraries and encoding frameworks that provide XSS protection
  • Disable active scripting in the browser, or add a plugin that does the same like NoScript
  • HTTPOnly flag on the session
  • Application layer firewall
54
Q

What is ESAPI?

A

OWASP ESAPI Encoding module

55
Q

What is Apache Wicket?

A

XSS proection

56
Q

Buffer Overflows

A

I know this already.

57
Q

How do you prevent buffer overflows?

A
  • Input size validation
  • Checking buffer size
  • Checking buffer bounds
  • Integer type checks
  • Truncation
  • Use a programming language that performs its own memory management and type safety
  • Use safe libraries
  • Don’t use banned API functions like strcpy()
  • Use unsigned integers whenever possible
  • Leverage compiler security
  • ASLR
  • DEP
  • memory checking tools
58
Q

What compiler features can prevent buffer overflows?

A
  • The Microsoft Visual Studio/GS flag
  • Fedora/Red Hat FORTIFY_SOURCE GCC flag
  • StackGuard
59
Q

What is ASLR

A

Address Space Layout Randomization

60
Q

What is DEP?

A

Data Execution Protection

61
Q

What are examples of broken authentication or session management?

A

MITM attacks, session hijacking, impersonation

62
Q

What is a CSRF?

A

Cross Site Request Forgery

An attacker forges a malicious HTTP request as a legitimate one and tricks the victim into submitting that request. Can be from an email, zero-byte image, etc.

Basically, trick a user into clicking something when they’re already authenticated.

63
Q

How can users prevent CSRF attacks?

A
  • Don’t save username in the browser
  • Don’t remember me
  • Dont’ use the same browser to surf and access sensitive sites
  • Read email in plain text
  • Log off after using a web app
  • Use client side browser extensions that mitigate CSRF (CSRF Protector)
64
Q

What can developers do to mitigate CSRF?

A
  • Use a session specific token (nonce)
  • CAPTCHAs
  • Validate uniqueness of session otkens ont he server
  • Use POST instead of GET for sensitive data along with a randomized session identifier
  • Use a double submitted cookie. Set the value in the form. Make sure they match. The attacker can change the form value, but not the cookie.
  • Check the URL referrer tag
  • Reauthenticate every time (complete remediation)
  • Transaction signing
  • Automated logout
  • Use OWASP CSRF Guard and OWASP ESAPI.
  • Mitigate XSS
65
Q

What is an insecure object direct reference flaw?

A

An insecure direct object reference flaw is one wherein an unauthorized user or process can invoke the internal functionality of the software by manipulating parameters and other object values that directly reference this functionality.

For example, passing the username in cleartext in a form.

66
Q

How can you prevent insecure object direct reference flaws?

A
  • avoid exposing internal functionality of the software using a direct object reference that can be easily manipulated
    *
67
Q

What is a surf jacking attack?

A

When a web site encrypts the authentication portion of the transaction but allows the session ID to be transmitted in cleartext, which an attacker then captures.

68
Q

What is a surf jacking attack?

A

When a web site encrypts the authentication portion of the transaction but allows the session ID to be transmitted in cleartext, which an attacker then captures.

69
Q

How should SSL certificates be set up?

A

they should be protected, properly configured, and not set to expire so that they are not spoofed. Educate users not to accept expired certificates.

70
Q

What controls can be used to mitigate insecure transport Layer Protection?

A
  • Provide end-to-end channel security protecting the channel using SSL/TLS or IPSec.
  • Avoid mixed SSL
  • Ensure that the session cookie’s secure flag is set. This causes the browser cookie to be sent only over encrypted channels (HTTPS and not HTTP) mitigating surf jacking attacks.
  • Use cryptography
  • Use unexpired and unrevoked certs
  • Properly configure certs
71
Q

What is pharming?

A

Modifying local system files to redirect users to fraudulent web sites, or DNS poisoning.

72
Q

What is differential fault analysis?

A

Fuzzing.

73
Q

What is a cold boot attack?

A

an attacker can extract secret information by freezing the data contents of memory chips and the booting up to recover the contents in memory.

Data remanence in RAM

74
Q

What is canonicalization?

A

the process of converting data that has more than one possible representation to conform to a standard canonical form.

75
Q

What is C14N?

A

Canonicalization

76
Q

What is Code Access Security?

A

in a managed code environment, when a software program is run, it is automatically evaluated to determine the set of permissions that needs to be given to the code during runtime. Based on what permissions are granted, the program will execute as expected or throw a security exception.

77
Q

In Code Access Security, what are the three categories of security actions that can be performed?

A

Requests - used to inform the runtime about the permissions that the code needs in order for it to run.

Demands -Demands are used in code to assert permissions and help protect resources from callers.

Overrides - Overrides are used in code to override default security behavior.

78
Q

What is declaractive security syntax?

A

In the context of CAS, declarative security syntax means that the permissions are defined as security attributes in the metadata of the code

79
Q

What is imperative security syntax?

A

Imperative security, on the other hand, is implemented using new instance of the permission object inline in code.

80
Q

What is CNG and what are its features?

A

The replacement to Microsoft’s CryptoAPI.

A new cryptographic configuration system that supports better cryptographic agility
Abstraction for key storage and separation of the storage from the algorithm operations
Process isolation for operations with long-term keys
Replaceable random number generators
Better export signing support
Thread-safety throughout the stack
Kernel-mode cryptographic API

81
Q

What is the difference between a dangling pointer and a wild pointer?

A

A dangling pointer is left when the object a valid pointer references is deleted.

A wild pointer is a pointer used before it is assigned anything.

82
Q

What is ASLR?

A

Address Space Layout Randomization

83
Q

What is ASLR?

A

Address Space Layout Randomization

A dll can be loaded into one of 256 different locations.

84
Q

What is DEP

A

Data Execution Prevention

85
Q

What is NX?

A

A sysnonym for DEP.

86
Q

What is ESP?

A

Executable Space Protection.

It’s the Unix/Linux equivalent of DEP.

87
Q

What does the /GS flag do?

A

the executable that is compiled is given the ability to detect and mitigate buffer overflows of the return address pointer stored on the stack memory.

Creates a security cookie before the return address of a function. If the cookie has been overwritten, the process terminates.

88
Q

What is StackGuard?

A

StackGuard is a compiler technique that provides code pointer integrity checking and protection of the return address in a function against being altered.

89
Q

What compiler does StackGuard work with?

A

gcc

90
Q

How does StackGuard work?

A

StackGuard works by placing a known value (referred to as a canary or canary word) before the return address on the stack so that, should a buffer overflow occur, the first datum that will be corrupted is the canary.

91
Q

What is a terminate or random canary?

A

A random canary is a 32-bit random number that is set on function entry (on program start) and maintained only for the time frame of that function call or program execution.

A terminator canary is made up of common termination symbols for C standard string library functions, such as 0 (null), CR, LF (carriage return, line feed), and -1 (End of File or EOF), and when the attacker specifies these common symbols in their overflow string as part of their exploit code (shellcode or payload), the functions will terminate immediately.

92
Q

What does /SAFESEH do?

A

It will produce the executable’s safe exception handlers table and write that information into the program executable (PE). This table in the PE is used to verify safe (or valid) exceptions by the OS. When an exception is thrown, the OS will check the exception handler against the safe exception handler list that is written in the PE, and if they do not match, the OS will terminate the process.

93
Q

How can you implement anti-tapering?

A

Obfuscation, which can be performed on source or object code.

94
Q

What is firmware?

A

Software for an embedded system.

95
Q

What is MILS?

A

The MILS architecture makes it possible to create a verified, always invoked, and tamperproof application code with security features that thwart the attempts of an attacker.

CSSLP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions