Chapter 6 - Mobile and Embedded Device Security Flashcards
What is an RTOS?
Real-Time Operation System - A specifically designed OS tuned for a SoC in an embedded or specialized system, it is to accommodate very high volumes of data very quickly
What is a SoC?
System on a Chip - an integrated circuit that combines all the essential components of a computer system, like the CPU, memory, input/output ports, and sometimes even a GPU, onto a single chip (Raspberry Pi)
What is a SCADA?
Supervisory Control And Data Acquisition - Systems help maintain efficiency and provide information on issues to help reduce downtime - Controls multiple ICSs
What is an ICS?
Industrial Control Systems - collect, monitor, and process real-time data so that machines can directly control devices such as valves, pumps, and motors without the need for human intervention
How to harden a SCADA and ICSs?
-ID all connections to the SCADA network
-Disconnecting the connections that are unnecessary
-Test
-Define Roles
-Identify security requirement
What is SecDevOps?
Process of integrating secure development best practices & methodologies into an application software development & deployment processes using the agile model
- Automation whenever possible
- Continuous modifications through the process with provision to roll back
What is Dead Code?
Is a section of an application that executes but performs no meaningful function
What is an Embedded System?
It is 1) computer hardware and software contained within a larger system 2) that is designed for a specific function.
-Fully functional computers integrated into a single chip
-Designed for a specific function
What does COPE mean?
Corporate Owned, Personally Enabled
What does CYOD mean?
Choose Your Own Device
What is Process Spawning Control?
Uses a vulnerable application to spawn executable files on the system
What is System Tampering?
Uses the vulnerability in an application to modify sensitive areas of the OS such as the Microsoft Windows registry keys
What is the agile model in app development?
An Incremental approach, works in small modules, at the end of each cycle the project’s priorities are evaluated as tests are being run
What is the waterfall model in app development?
A Sequential design process where quality assurance occurs after the application has been tested and before going to production
What is static code analysis?
Review code line by line for errors
What is dynamic code analysis?
Runtime Verification - Security testing preformed after the source code is compiled and when all components are integrated and running
-(code analysis tools use a process called fuzzing)
What is the fuzzing process?
Provides random input to a program in an attempt to trigger exceptions, such as memory corruption, program crashes, or security breaches - an advantage of it, is that it produces a record of what input triggered the exception so it can be reproduced to track down the problem within the code.
What is OTA?
Over-the-Air, usually security updates that go to mobile devices
What is Celluar?
Coverage area for a cellular telephony network divided into cells MTSO (Mobile Telecommunication Switching Office) that controls the transmitters in a cellular network
What is MTSO?
Mobile Telecommunication Switching Office - controls the transmitters in a cellular network
What is VDI?
Virtual Desktop Infrastructure - Stores sensitive data and apps on a remote server
What is are limited updates?
Patches & updates are distributed through firmware Over-the-Air (OTA) updates
What is unauthorized recording?
Infecting a device with malware, a threat actor can spy on an unsuspecting victim & record conversations or video could pose as “legit” programs
What is Geofencing?
Restricting an app’s use to a location
What is Tethering?
Share internet connection
What is Jailbreaking a device?
Apple
What is Rooting a device?
Android
What is containerization?
Separating storage into business& personal “containers”
What is MCM?
Mobile Content Management - Creation, editing, and modification of digital content multiple employees
What is an UEM?
Unified Endpoint Management - All MDM, MAM, and MCM together
What is a Raspberry Pi?
Low cost, credit card size computer motherboard
What is a FPGA?
Field-Programmable Gate Array - A hardware “chip” that can be programed by the user to carry out one or more logical operations
What is an IoT?
Internet of Things - Is connecting any device to the Internet for the purpose of sending & receiving data to be acted upon (low resilience)
What is an executable files attack?
Trick the vulnerable app to create or modify executable files
