Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Chapter 6 - Application Security > Flashcards

Chapter 6 - Application Security Flashcards

1
Q

Software Development Life Cycle (SDLC)

A

The SDLC describes the steps in a model for software development throughout its life.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the main steps of the Software Development Life Cycle?

A
  1. Planning
  2. Requirements
  3. Design
  4. Coding
  5. Testing
  6. Training and Transition
  7. Ongoing Operations and Maintenance
  8. End of Life Decommissioning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the four most common types of Code Deployment Environments?

A
  1. Development Environment
  2. Test Environment
  3. Staging Environment
  4. Production Environment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

DevOps

A

DevOps combines software development and IT operations with the goal of optimizing the SDLC. This is done by using collections of tools called toolchains to improve the SDLC processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Continuous Integration (CI)

A

Continuous Integration (CI) is a development practice that consistently checks code into a shared repository. The main goal of this approach is to enable the use of automation and scripting to implement automated courses of action that result in continuous delivery of code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Continuous Deployment/Delivery (CD)

A

Continuous Deployment (CD) rolls out tested changes into production automatically as soon as they have been tested. Using continuous integration and continuous deployment methods requires building continuous validation and automated security testing into the pipeline testing process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Application Programming Interfaces (API)

A

APIs are interfaces between clients and servers or applications and operating systems that define how the client should ask for information from the server and how the server will respond.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Static Code Analysis

A

Static Code Analysis is conducted by reviewing the code for an application. Static Analysis does not run the program; instead, it focuses on understanding how the program is written and what the code is intended to do.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Dynamic Code Analysis

A

Dynamic Code Analysis relies on execution of the code while providing it with input to test the software. Automated dynamic analysis will run all of the interfaces that the code exposes to the user with a variety of inputs, searching for vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Fuzzing

A

Fuzzing involves sending invalid or random data to an application to test its ability to handle unexpected data. The application is monitored to determine if it crashes, fails or responds in an incorrect manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Injection Vulnerabilities

A

Injection Vulnerabilities allow an attacker to supply some type of code to the web application as input and trick the web server into either executing that code or supplying it to another server to execute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Blind Content-Based SQL Injection

A

In a Blind Content-Based SQL Injection attack, the perpetrator sends input to the web application that tests whether the application is interpreting injected code before attempting to carry out an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Blind Timing-Based SQL Injection

A

In a Blind Timing-Based SQL Injection attack, the amount of time required to process a query is used as a channel for retrieving information from a database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Session Hijacking

A

Session Hijacking attacks take over an already authenticated session with a website/application. An attacker can steal a cookie managed by the target user’s web browser to impersonate them and gain access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Unvalidated Redirects

A

Unvalidated Redirects allow an attacker to redirect the user to a malicious site. Some web applications allow the browser to pass destination URLs to the application and then redirect the user to that URL at the completion of their transaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Insecure Direct Object Reference

A

Insecure Direct Object References allow users to view information that exceeds their authority. These attacks can occur when a web application does not perform authorization checks for each request.

17
Q

Directory Traversal

A

Directory Traversal attacks work when web servers allow the inclusion of operators that navigate directory paths and filesystem access controls don’t properly restrict access to files stored elsewhere on the server.

18
Q

File Inclusion Attacks

A

File Inclusion Attacks execute the code contained within a file, allowing the attacker to fool the web server into executing arbitrary code.

19
Q

Privilege Escalation

A

Privilege Escalation attacks seek to increase the level of access that an attacker has to a target system.

20
Q

Cross-Site Scripting (XSS)

A

Cross-Site Scripting (XSS) attacks occur when web applications allow an attacker to perform HTML injection, inserting their own HTML code into a web page. A malicious individual could embed form input in a link to a legitimate website.

21
Q

Request Forgery Attacks

A

Request Forgery Attacks exploit trust relationships and attempt to have users unwittingly execute commands against a remote server.

22
Q

Cross-Site Request Forgery (XSRF)

A

Cross-Site Request Forgery (XSRF) attacks work by making the reasonable assumption that users are often logged into many different websites simultaneously. Attackers will embed code in one website that sends a command to a second website (that the user is already presumably logged into).

23
Q

Input Validation

A

Input Validation is the process of handling user input and ensuring that it fits an appropriate pattern before sending the input to the next step. For web applications, input validation should always be performed server-side.

24
Q

Web-Application Firewall (WAF)

A

Web-Application Firewalls (WAFs) function similarly to network firewalls, but they work at the Application layer. A WAF sits in front of a web server, and receives all network traffic headed to that server, performing its own input validation on the data before sending it along to the web server.

25
Q

Sandboxing

A

Sandboxing is the practice of running an application in a controlled or isolated environment to prevent it from interacting negatively with other system resources or applications.

26
Q

Code Repositories

A

Code Repositories are centralized locations for the storage and management of application source code.

27
Q

Code Signing

A

Code Signing provides developers with a way to confirm the authenticity of their code to end users. Developers use a cryptographic function to digitally sign their code with their own private key and then browsers can use the developer’s public key to verify that signature and ensure that the code is legitimate and was not modified by unauthorized individuals.

28
Q

Scalability

A

Scalability says that applications should be designed so that computing resources they require may be incrementally added to support increasing demand.

29
Q

Elasticity

A

Elasticity says that applications should be able to provision resources automatically to scale when necessary and then automatically deprovision those resources to reduce capacity when it is no longer needed.

30
Q

Race Condition

A

Race Conditions occur when the security of a code segment depends upon the sequence of events occurring within a system.

31
Q

Security Orchestration, Automation and Response (SOAR)

A

SOAR platforms provide many opportunities to automate security tasks that cross between multiple systems. Cybersecurity professionals can also use scripting languages such as Python, Bash or PowerShell to achieve their automation goals.

32
Q

What are some of the potential challenges that might arise during the implementation of automation?

A
  1. Complexity
  2. Cost
  3. Single point of failure
  4. Technical debt
  5. Ongoing supportability
33
Q

What are some of the common use cases for automation and scripting?

A
  1. User provisioning
  2. Resource provisioning
  3. Guard rails (prevent violation of security protocols)
  4. Security groups
  5. Ticket creation
  6. Escalation
  7. Enabling/disabling services and access
  8. Continuous integration and testing
  9. Integrations and APIs
34
Q

What are some benefits of automation and scripting?

A
  1. Achieving efficiency and time savings
  2. Enforcing baselines
  3. Standardizing infrastructure configurations
  4. Scaling in a secure manner

Security+ (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions