Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My Notes of CISSP CBK > Chapter 4- Software Development Security > Flashcards

Chapter 4- Software Development Security Flashcards

1
Q

SDLC Basic Phases

A

Project Initiation and Planning; Functional Requirements Definition; System Design Specification; Developmnet and Implementation; Documentation and common program controls; Testing and evaluation control (C&A); Transistion to production (implementation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SLC

A

Extends above SDLC - Operations and maintenance support; revisions and system replacement; project initiation and planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Project Initiation

A

Security activities should be done in parallel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Functional Requirements

A

Security requirements should be formalized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

System Design Specifications

A

security features designed, generally based on the overall security architecture for the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Development and Implementation

A

code should be analyzed to eliminate common vulnerabilities that might lead to security exploits and other risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Documentation and Common Program Controls

A

types of logging the program should be doing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Acceptance

A

tested to ensure it meets all the functional and security requirements. Testing is to ensure that the application meets its security requirements and specifications and uncover all design flaws that would violate security policy. Run independently in a production simulation environment. First Phase of C&A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Testing and Evaluation Controls

A

bounds checking and data validation - test data should not be production data. test all changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

C&A

A

Certification and Accreditation - Certification is the process of evaluating security stance of the software and against a set of security standards or policies. Verify conversion. Accreditation - Acceptable level of risk is determined. Provisional accreditation is for a specific period and outlines specific changes. Full means no changes required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Transition to Production (implementation)

A

obtain security accreditation, train users, implement, parallel operations if necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Revisions and System Replacement

A

Changes must follow SDLC and be recorded in change managment system. Reviews should inlcude security planning and procedures - application audits should be conducted periodically including documentatin security incidents and system failures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CMM

A

Capability Maturity Model for Software - focuses on quality management process and has 5 maturity levels. ISO 9000 includes software development quality standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Waterfall life-cycle method

A

oldest method - list of activities that must be completed before the next phase begins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Structured Programming Development

A

promotes discipline, allows introspection, and provides controlled flexibility - requires defined processes and modular development - each phase is subject to reviews and appraisals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Spiral Method

A

nested version of the Waterfall method. - Plan DO Check Act sub phases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Clean room

A

method of controlling defects - focuses defect prevention. more time spent in early phases.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Iterative development

A

successive refinements of requirements, design, and coding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Prototyping

A

simplified version, release for review, user feed back build better second version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Modified Prootype model

A

ideal for Web app development - deployed in quick time frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Rapid application development

A

strict time limits on each phase - rapid prototyping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Joint Analysis Development

A

developers work directly with users to develop a working application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Exploratory Model

A

set of requirements built with what is currently available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

CASE

A

computer-aided software engineering - use computers and utilities to help with systematic analysis, desing, development, implementation and maintenance of software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Component based development

A

standardized building blocks to assemble rather than develop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Reuse model

A

built from existing components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Extreme programming

A

values of simplicity, communication and feedback - fairly structured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

DBMS

A

a suite of application programs that typically manage large structured sets of persistant data. 4 elements - database engine, hardware platform, application software and users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Transaction persistence

A

state of the database is the same after a transaction has occured and transaction should be durable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Fault Tolerance and recovery

A

in case of failure data should remain int its original state. Two types of recovery - rollback and shadowing. Rollback - incomplete transactions are backed out. Shadow requires the use of transaction logging to indetify the last good transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Hierarchial Database Management Model

A

stores data in a series or records together as a record type. These record types are the equivalent of tables in a relational model. can only cope with a single tree

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Network Database Management Model

A

refers to method of how data is linked to other data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Relational Database Management Model

A

series of tables that have columns representating variables and rows containing specific instances of data. Tables/Relations data structures; Integrity rules on allowable values and combinations of values; data manipulation agents. Rows/Tuples - Columns/Attributes atomic - every row/column position - one data value concurrency - dbms interleaves actions (read/writes) of various transactions atomicity - execute all actions in one step or not executing any actions at all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Integrity

A

Entity Integrity and Referential Integrity derived from Clark and Wilson. Entity - tuple must have a unique and non null value in the primary key. Referential - for any foreign key value, the referenced relation must have a tuple with the same value for its primary key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Schema

A

structure of a database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Tables

A

columns and rows of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Views

A

defines what a user can view

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

DDL

A

used to create databases, tables, view, indices

39
Q

DML

A

used to query and extract data

40
Q

DCL

A

commit, savepoint, rollback, set transaction

41
Q

Object oriented database

A

interact with applications without the language overhead

42
Q

object-relational

A

hybrid - provides updrade path

43
Q

ODBC

A

Open Database Connectivity - API between applications and databases - credentials stored in clear text - Microsoft

44
Q

JDBC

A

Java Database Connectivity - connect directly or through ODBC - Sun Microsystems

45
Q

XML

A

eXtensible Markup Language - structuring data in a text file. W3C standard since 1998

46
Q

OLE DB

A

Object Linking and Embedding Database - object embedded or linked to the inside of another object. The component object model (COM) is the protocol that allows OLE to work.

47
Q

Tiered application approach

A

Presentation, business logic layer and data layer

48
Q

ActiveX Data Objects

A

ADO- interface for all kinds of data

49
Q

Dublin Core

A

metadata element standard - the availability of a practical , usable namespace.

50
Q

OLAP

A

Online Analytical Processing - formulate queries

51
Q

Data mining

A

decision making technique

52
Q

Aggregation and Inference

A

ability to combine nonsensitive data from separate source to create sensitive information Inference - ability to deduce sensitive or restricted information from observing available information

53
Q

Bypass attacks

A

bypass front end application controls and directly access and manipulate data

54
Q

concurrency

A

when actions are processes run at the same time

55
Q

data contamination

A

input data errors affects integrity

56
Q

deadlocking

A

two users try to access at the same time

57
Q

Atomicity

A

ACID - A - all parts of transactions are either committed or rolled back

58
Q

Consistency

A

ACID - C - database is transformed from one valid state to another valid state

59
Q

Isolation and Durability

A

ACID - I - transaction is invisible until complete ACID - D - results of completed transaction are permanent

60
Q

OLTP

A

online transaction processing

61
Q

Neural networks

A

develop classification, regression, association, and segmentation models based on the way neurons work in the human brain

62
Q

HTTP

A

stateless technology

63
Q

von Neumann

A

all computers today - no inherent difference between data and programming in the memory of the computer

64
Q

citizen programmers

A

unlikely to be trained in system development practices

65
Q

covert channel

A

information flow issue. allows two cooperating processes to transfer information in such a way that it violates the system’s security policy. Two types: storage and timing

66
Q

virus

A

defined by its ability to reproduce and spread

67
Q

worm

A

spreads on its own

68
Q

multipartitie

A

originally named to indicate that it was able to infect both boot sectors and program files. - now can affect more than one type of object.

69
Q

macro virus

A

infect data files and tend to remain resident - operates across hardware or operating system platforms -

70
Q

script virus

A

stand alone files that can be executed by an interpreter

71
Q

trojan

A

pretends to do one thing while performing another unwanted action.

72
Q

RAT

A

remote access trojan

73
Q

The key objective of application security is to ensure: A. that the software is hacker proof B. the confidentiality, integrity and availability of data C. accountability of software and user activity D. prevent data theft

A

B. the confidentiality, integrity and availability of data

74
Q

For an application security program to be effective within an organization, it is critical to A. Identify regulatory and compliance requirements B. Educate the software development organization the impact of insecure programming C. Develop the security policy that can be enforced D. Properly test all the software that is developed by your organization for security vulnerabilities

A

C. Develop the security policy that can be enforced

75
Q

The best defense against session hijacking and man in the middle attacks is to use which of the following in the development software: A. Unique and random identification B. Use prepared statements and procedures C. Database views D. Encryption

A

A. Unique and random identification

76
Q

An important characteristic of bytecode is that is A. has increased secure inherently due to sandboxing B. manages memory operations automatically C. is more difficult to reverse engineer D. is faster than interpreted languages

A

D. is faster than interpreted languages

77
Q

Two cooperating processes simultaneously compete for a shared resource, in such a way that they violate the system’s security policy, is commonly known as A. Covert channel B. Denial of Service C. Overt Channel D. Object resue

A

A. Covert channel

78
Q

An organization has a website with a guest book feature, where visitors to the web site can input there names and comments about the organization. Each time the guest book web page loads, a message box is prompted with the message “You have been POwnd” followed by redirection to a different website. Analysis reveals that the no input validation or output encoding is being performed in the web application. This is the basis for which type of attack? A. Denial of Service B. Cross-site scripting (XSS) C. Malicious File Execution D. Injection Flaws

A

B. Cross-site scripting (XSS)

79
Q

The art of influencing people to divulge sensitive information about themselves or their organization by either coercion or masquerading as a valid entity is known as A. Dumpster Diving B. Shoulder Surfing C. Phishing D. Social Engineering

A

D. Social Engineering

80
Q

An organization’s server audit logs indicate that an employee that was terminated in the morning was still able to access certain sensitive resources on his system, on the internal network, that afternoon. The logs indicate that the employee had logged on successfully before he was terminated but there is no record of him logging off before he was terminated. This is an example of which type of attack? A. time of check/time of use (toc/tou) B. Logic bomb C. Remote- access Trojans (RATs) D. Phishing

A

A. time of check/time of use (toc/tou)

81
Q

The most effective defense against a buffer overflow attack is A. disallowing dynamic construction of queries B. bounds checking C. encoding output D. forced garbage collection

A

B. bounds checking

82
Q

It is extremely important that as one follows a software development project, security activities are performed A. before release to production, so that the project is not delayed B. if a vulnerability is detected in your software C. in each stage of the life cycle D. when management mandates it

A

C. in each stage of the life cycle

83
Q

audit logs are what type of control? A. Preventative B. Detective C. Compensating D. Corrective

A

B. Detective

84
Q

Who can enforce the separation of duties by ensuring that programmers do not have access to production code? A. Operations Personnel B. software librarian C. Management D. Quality Assurance personnel

A

B. software librarian

85
Q

The technical evaluation of assurance to ensure that security requirements have been met is known as? A. Accreditation B. Certification C. Validation D. Verification

A

B. Certification

86
Q

defect prevention rather than defect removal is characteristic of which of the following software development methodology A. Computer Aided Software Engineering (CASE) B. Spiral C. Waterfall D. Cleanroom

A

D. Cleanroom

87
Q

A security protection mechanism in which untrusted code, which is unsigned, is restricted from accessing system resources is known as? A. Sandboxing B. Non-repudiation C. Separation of Duties D. Obfuscation

A

A. Sandboxing

88
Q

A program that does not reproduce itself but pretends to be performing a legitimate action, while actually performing malicious operations in the background, is the characteristic of which of the following A. Worms B. Trapdoor C. Virus D. Trojan

A

D. Trojan

89
Q

A plot to take insignificant pennies from a user’s bank account is an example of A. Social Engineering B. Salami Attack C. Pranks D. Hoaxes

A

B. Salami Attack

90
Q

role based access control to protect confidentiality of data in databases can be best achieved through which of the following? A. Views B. Encryption C. Hashing D. Masking

A

A. Views

91
Q

The two most dangerous database attacks containing disparate non-sensitive information are A. Injection and scripting B. Session hijacking and cookie poisoning C. Aggregation and inference D. Bypassing authentication and insecure cryptography

A

C. Aggregation and inference

92
Q

A property that ensures only valid or legal transactions that do not violate any user-defined integrity constraints in DBMS technologies is known as A. Atomicity B. Consistency C. Isolation D. Durability

A

B. Consistency

93
Q

Expert systems are comprised of a knowledge base containing modeled human experience and which of the following? A. Inference engine B. Statistical models C. Neural networks D. Roles

A

A. Inference engine

My Notes of CISSP CBK (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions