Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSSLP > Chapter 6 - Software Acceptance > Flashcards

Chapter 6 - Software Acceptance Flashcards

1
Q

What is V&V

A

Validation and Verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is C&A

A

Certification and Accrediation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Software Acceptance?

A

Software acceptance is the process of officially or formally accepting new or modified software components that, when integrated, form the information system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the objectives of software acceptance?

A
  • Verification that the software meets specified functional and assurance requirements
  • Verification that the software is operationally complete and secure as expected
  • Obtaining the approvals from the system owner
  • Transference of responsibility from the development team or company (vendor) to the system owner, support staff, and operations personnel if the software is deployed internally
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the guiding principles of software ready for release?

A
  • Be secure by design, default, and deployment (Howard and LeBlanc, 2003)
  • Complement existing defense in depth protection
  • Run with least privilege
  • Be irreversible and tamper-proof
  • Isolate and protect administrative functionality and security management interfaces (SMIs)
  • Have nontechnical protection mechanisms in place
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is SD3?

A

Shorthand for “Secure in Design, Default, and Deployment”. The mantra for defense-in-depth.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why are EULA’s considered ineffective?

A

They are deterrent controls, not preventive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How can you prevent reverse engineering?

A

Code obfuscation and anti-tampering techniques. Previentive controls like EULAs, DMCA, etc, offer more than nothing, but the book calls them ineffective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is RCE?

A

Reverse Code Enginering, aka reverse engineering code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why is formal software acceptance important?

A

It’s the final checkpoint for discovering the existence of missed and unforeseen security vulnerabilities and for validating the presence of security controls that will address known threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What items should be considered before accepting sftware built in-house?

A

Completion: Are all functional and security requirements completed?

Change management: Is there a process in place to handle change requests?

Approval to deploy/release: Have all required authorities signed off

Risk acceptance and exception policy: Is residual risk acceptance tracked if it’s not within the threshold

Documentation: Is all necessary documentation in place?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a RTM?

A

Requirements Traceability Matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a RTM?

A

Requirements Traceability Matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the purpose of software completion criteria?

A

Ensuring that the functional and security requirements captured during the requirements gathering phase have been fully met.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What security related milestones should be considered as completion criteria?

A
  • Generation of the requirements traceability matrix (RTM) that includes security requirements besides functional requirements in the requirement phase
  • Completion of the threat model during the design phase
  • Review and sign-off on the security architecture at the end of the design phase
  • Review of code for security vulnerabilities after the development phase
  • Completion of security testing at the end of the application testing phase
  • Completion of documentation before the deployment phase commences
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

All security-related milestones should include?

A

An actual deliverable, like a RTM, threat model, security architecture design, code review report, security test report) that can be tracked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What should a threat model include?

A

documented threat lists and associated controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What should the architecture review sign off include?

A

the various components of the security profile and principles of secure design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What larger process is change management part of?

A

Configuration management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a PMO?

A

Program Managment Office

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a CCB

A

Configuration/Change Board.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What should be verified as part of the software acceptance process?

A
  • Change requests are evaluated for impact on the overall security of the software.
  • The asset management database is updated with the new/updated software information.
  • The change is requested formally, and evaluated and approved by appropriate signatory authorities.
23
Q

Who should accept risk?

A

The business owner, not an IT official.

24
Q

What elements should a risk acceptance tempalte use?

A

Risk, actions, issues, decisions.

25
Q

What is an AO?

A

Authorizing Official

26
Q

What are the options to address risk?

A

Accept, Transfer, Mitigate, Avoid

27
Q

How might you avoid risk?

A

Stop using the affected software.

28
Q

How might you transfer risk?

A

Insurance

29
Q

How might you accept risk?

A

This is simply a decision, but one that should be documented.

30
Q

What should members of the exception review board include?

A

Experts from differnt teams, such as business, software development, legal, privacy, and security.

31
Q

What is the most overlooked portion of the SDLC?

A

Documentation

32
Q

What documentaiton needs to be verified as complete?

A 
RTM
Threat model
Risk Acceptance Document
Exception Policy Document
Change requests
Approvals
BCP or DRP
Incident Response Plan
Installation Guide
User Training Guide/Manual
33
Q

What is TCO

A

Total Cost of Ownership, which includes the cost of support and maintenance and the investment of time and resources necessary to incorporate security when it is deployed within your organization’s computing ecosystem.

34
Q

What protection mechanisms can be used if you are outsourcing software development

A 
Contractual oblications
Require the vendor to integrate security into their SDLC
Code verification (code review)
35
Q

What should be in RFP to ensure secure software?

A

Explicitly stated security requirements
RFPs should be time-bound
Evaluation criteria should be predefined and explicitly stated

Respondents should demonstrate an understanding of the requirements, a solution, experience of their personnel, valid references, resources, cost, and schedule considerations.

36
Q

What is the strongest form of Intellectual Property protection?

A

Patents

37
Q

What are the requirements for a patent?

A

It must be of practical use

It must be novel, with at least one new characteristic that is nonexistent in the domain of existing knowledge (technical field).

It must demonstrate an inventive step

It must be compliant with the law and deemed as acceptable in a court of law

38
Q

What is a trademark?

A

Trademarks are distinctive signs that can be used to identify the maker uniquely from others who produce a similar product.

39
Q

How long can trademarks last?

A

Indefinitely, but they have to be renewed.

40
Q

What is a trade secret?

A

Any confidential business information that provides a company with a competitive advantage.

The information must not be generally known, readily accessible, or reasonably ascertainable.

It must have commercial value that is lost or reduced should the information be disclosed.

It must be protected by the holder of the information (e.g., through confidentiality agreements).

41
Q

What must be done for trade secret protection to attach to software?

A

Just being in object code is not enough (cite?).

Requires developer NDAs and protection against reverse engineering.

42
Q

What is “verification”?

A

As part of the V&V process, verification ensures that the software performs as it is required and designed to do.

43
Q

What is “validation”?

A

Validation is the process of evaluating software during and/or at the end of the development process to determine whether it satisfies specified requirements.

44
Q

What mechanisms should V&V look for?

A

security protection mechanisms to ensure confidentiality, integrity of data and system, availability, authentication, authorization, auditing, secure session management, proper exception handling, and configuration management.

45
Q

What are EALs?

A

Common Criteria Evaluation Assurance Levels.

46
Q

What must a formal review include?

A

Design and code review.

47
Q

What is the Fagan process?

A

a highly structured process with several steps to determine defects in development results, such as specifications, design, and code.

48
Q

What kinds of tests are performed during V&V?

A

Error detection and acceptance.

49
Q

What is IV&V?

A

Independent Verification and Validation

50
Q

Why is it bad to rely on tools to perform V&V?

A

False positives and false negatives. Tools don’t complety emulate human experience and decision-making capability.

51
Q

What standard provides guidance for bodies providing audit and certification of an information security management system (ISMS) and is primarily intended to support software accreditation?

A

ISO/IEC 27006-2007

52
Q

Security certification should include evalution of the following at a minimum:

A
  • User rights, privileges, and profile management
  • Sensitivity of data and application and appropriate controls
  • Configurations of system, facility, and locations
  • Interconnectivity and dependencies
  • Operational security mode
53
Q

What documents are considered part of the Risk Acceptance documentaiton?

A

Disaster Recovery and Business Continuity Plans

Excepiton policy and Sign Off

CSSLP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions