Chapter 6 Flashcards
SDLC (Software Development Life Cycle)
The steps in a model for software development throughout its life.
Feasibility Phase
Initial investigations into whether the effort should occur are conducted.
Analysis/Requirements Phase
Customer input is sought to determine what the desired functionality is.
Design Phase
Design for functionality, architecture, integration, and any other elements that require design consideration.
Development Phase
Coding the of the application.
UAT (User Acceptance Testing)
Testing that ensures that the users of the software are satisfied.
Testing/Integration Phase
Formal testing with customers or others outside the development team.
Maintenance Phase
Patching, updating, minor modifications, and other work that goes into daily support.
Disposition Phase
The end of a products life, is sometimes shutdown.
Waterfall Model
A sequential development model in which each phase is followed by the next.
Spiral Model
A development model that uses linear concepts from the Waterfall model and adds an iterative process that revisits phases multiple times throughout the development cycle.
Agile Model
A development model that is iterative and incremental rather than linear.
Continuous Integration
A development practice that checks code into a shared repository on a consistent basis.
OWASP
Define Security Requirements
Leverage Security Frameworks
Secure Database Access
Encode and Escape Data
Validate All Inputs
Implement Digital Identity
Enforce Access Controls
Protect Data Everywhere
Implement Logging and Monitoring
Handle all Errors and Exceptions
API (Application Programming Interface)
Interfaces between clients and servers or applications and operating systems that define how the client should ask for information from the server and how the server will respond.
Pair Programming
An Agile software development technique that places two developers at one workstation.
Over-the-Shoulder
Relies on a pair of developers and requires one developer to explain the code to the other.
Pass-around Code Review
A form of manual peer review done by sending completed code to reviewers who check the code for issues.
Tool-assisted
Relies on software based tools to conduct code reviews.
Fagan Inspection
A structured formal code review intended to find a variety of problems during the development process.
Static Code Analysis
Reviewing the source code for an application.
Dynamic Code Analysis
Executing the code and using inputs to test the software.
Fuzz Testing
Sending invalid or random data to an application to test its ability to handle unexpected data.
Injection Vulnerabilities
An attacker supplies some type of code to a web application as input to trick the web server into executing the code or supplying it to another server to execute.
Session Hijacking
Stealing an existing authenticated session with a website.
Directory Traversal Attack
AN attack that uses a security misconfiguration to navigate directory structures to access files that should remain secure.
File Inclusion Attack
Uses directory traversal to actually execute the code contained in a file.
XSS (Cross-Site Scripting)
Attackers perform an HTML injection by inserting their own HTML code into a web page.
Request Forgery Attack
Exploit trust relationships and attempt to have users unwittingly execute commands against a remote server.
XSRF or CSRF (Cross-site Request Forgery)
An attack that exploits the trust that a user has in a website to execute code on the user’s computer.
SSRF (Server-side Request Forgery)
An attack that tricks a server into visiting a URL based on user-supplied input.
WAF (Web Application Firewall)
A “firewall” that works at the Application Layer and receives all network traffic headed to that server. It then perform input validation before passing that info on to the server.
Database Normalization
A Set of design principle that database designers should follow when building and modifying databases.
Code Signing
Provides developers a way to confirm the authenticity of their code to end users.
SWG (Secure Web Gateway)
Protects users working in the office or outside the office who are accessing resources from the internet.
OWASP (Open Web Application Security Project)
Provides a regularly updated list of proactive controls regarding security threats to web applications.
CI/CD (Continuous Integration/Continuous Delivery)
Ensures that code vulnerabilities can be patched and updated code placed into production as quickly as possible.
