Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 7: Software Development Security > Flashcards

Chapter 7: Software Development Security Flashcards

1
Q

Describe local/nondistributed computing.

A

All user-executed code is stored on the single machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a logic bomb?

A

A malicious code object that lies dormant until events occur that satisfy one or more logical conditions, at which time they deliver their payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a worm?

A

A malicious code object that spreads from ssytem to system bearing some type of malicious payload. Unlike viruses, they are self-replicating, requiring no user interaction to propagate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is distributed computing?

A

Allowing a user to harness the computing power of one or more remote systems to achieve a single goal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an agent or bot?

A

Intelligent code objects that perform actions on behalf of a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is an applet?

A

A code object sent from a server to a client to perform some action. A miniature program that executes independently of the server that sent it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the benefits of applets?

A

Processing is shifted to the client, freeing up resources on the server
The client can produce datat using local resources rather than waiting for th eremote server, often speeding response.
All data can stay on the client, improving security from the client’s perspective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the distinctions between Java and ActiveX applets?

A

ActiveX is Microsoft only.

ActiveX is not subject to sandbox restrictions, and has full access to the client system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a database view?

A

SQL statements that present data to the user as if it were a table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is concurrency or edit control in the database context?

A

A preventative security mechanism that endeavors to make sure that the information in the database is always ocrrect or has its integrity and availability protected. Locking, so only one user at a time can make changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is polyinstantiation?

A

When two or more rows in the same relational database table appear to have identical primary key elements but contain different data for use at differing classification levels. Often used as a defense against some times of inference attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a data warehouse?

A

Large databases used to store large amounts of information from a variety of databases for use with specialized analysis techniques. Often contain detailed historical information not normally stored in production databases because of storage limitations or security concerns.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a data dictionary?

A

Used for storing critical information about data including usage, type, sources, relationshipts, and formats. Determines access rights for users attempting to access data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is data mining?

A

Techniques for combing through data warehouses to look for potential correlated information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a data mart?

A

p. 292. Not well defined.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is primary or real memory?

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is secondary storage?

A

magnetic and optical media, tapes, disks, hard drives, falsh drives, CD/DVD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is virtual memory?

A

Simulating primary storage through use of secondary storage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is virtual storage?

A

Simulating secondary storage through the use of primary storage. For example, a RAM disk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is random access storage?

A

Storage that allows the operating system to request contents from any point within the media. RAM, for example, but not tape.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is sequential access storage?

A

Storage that requires scanning through the entire media from the beginning to reach an address. Commonly, tapes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is volatile storage?

A

Storage that loses its contents when power is removed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is nonvolatile storage?

A

Storage that does not depend on the presence of power to maintain its contents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an expert system?

A

A system that seeks to embody the accumulated knowledge of experts and apply it in a consistent fashion to future decisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a risk of expert systems?

A

They’re not infalliable. They’re only as good as the data in the knowledge base and the decision making algorithms implemented in the inference engine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a neural network?

A

Chains of computational units used in an attempt to imitate the biological reasoning process of the human mind.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How do neural networks work?

A

They use many layers of summation, each of which requires weighting information to reflect the relative importance of the calculation in the overall decision making process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a decision support system?

A

A knowledge-based application that analyzes business data and presents it in such a way as to make business decisions easier for users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define fail-secure.

A

A fail-secure state puts the system in a high level of security and may even disable it entirely until an administrator can diagnose the problem and restore the system to normal operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define fail-open

A

Allows users to bypass failed security controls, erring on the side of permissiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Define first generation languages.

A

All machine languages

32
Q

Define second generation languages.

A

All assembly languages

33
Q

Define third generation languages

A

All compiled languages

34
Q

Define fourth generation languages

A

Languages that attempt to approximate natural languages. Includes SQL

35
Q

Define fifth generation languages.

A

Programmers create code using visual interfaces

36
Q

What is the Systems Development Life Cycle?

A 
Conceptual definition
Functional requirements determination
Control specification development
design review
Code review walk-through
System test review
Maintenance and change management
37
Q

What is a Conceptual Definition?

A

A simple statement agreed upon by all interested stakeholders that states the purpose of the project as well as the general system requirements.

38
Q

What is Functional Requirements Determination?

A

Listing specific system functionalities, consideration of how the parts should interoperate to meet the functional requirements. The deliverable is a document that lists the specific system requireemnts.

39
Q

What is Control Specifications Development?

A

Don’t retrofit security. Design it in.

40
Q

What is Design Review?

A

Designers determining exactly how the various parts of the system will interoperate and how the modular system structure will be laid out.

41
Q

What is Code Review Walk-Through?

A

Technical meetings usually involving only development personnel who walk through the actual code, looking for problems in the logical flow or other design/security flaws.

42
Q

What is System Test Review?

A

p 305

43
Q

What is Maintenance and Change Management?

A

Maintenance tasks once a system is operational that respond to changing operational, data processing, storage, and environmental requirements.

44
Q

List the Life Cycle Models

A 
Waterfall
Spiral
Agile Software Development
Software Capability Maturity Model
IDEAL Model
45
Q

Describe the Waterfall Life Cycle Model

A

p306

46
Q

Describe the Spiral Life Cycle Model

A

p308

47
Q

Describe the Agile Software Development Model

A

p308

48
Q

Describe the Software Capability Maturity Model

A

p310

49
Q

Describe the IDEAL Life Cycle Model

A

p310

50
Q

What is a Gantt chart?

A

A type of bar chart that shows the interrelationships over time between projects and schedules.

51
Q

What is a PERT chart?

A

Program Evaluation Review Technique. A project scheduling tool used ot judge the size of a software product in deelopment and calculate the standard deviation for risk assesment. Calculates smallest, most likely, largest size for each component.

52
Q

What are the components of Change Management?

A

Request control
Change control
Release control

53
Q

Describe Request Control

A

.

54
Q

Describe Change Control

A

.

55
Q

Describe Release Control

A

.

56
Q

What are the components of configuration management?

A

Configuration Identification
Configuration Control
Configuration status accounting
Configuration Audit

57
Q

Describe Configuration Identification

A

.

58
Q

Describe Configuration Control

A

.

59
Q

Describe Confiugruation Status Accounting

A

.

60
Q

Describe Configuration Audit

A

.

61
Q

What are the three testing methods or ideologies?

A

White box
Black box
Grey Box

62
Q

White box testing?

A

.

63
Q

Grey box testing?

A

.

64
Q

Black box testing?

A

.

65
Q

What are the two categories of testing used to evaluate application security?

A

Static and dynamic testing.

66
Q

Describe static and dynamic testing

A

.

67
Q

What are the principles of Security Control Architecture?

A

Process Isolation
Protection Rings
Abstraction
Security Modes

68
Q

What is Protection Ring 0?

A

The ring where the OS itself resides. Supervisory or privilege mode. Validates all requests for access to hardware.

69
Q

What are Protection Rings 1 and 2?

A

These contain device drivers and other operating system services that provide higher level interfaces to system resources. In practice, most OSes don’t implement this.

70
Q

What is Protection Ring 3?

A

User applications and processes. User or protected mode. Direct access to system resources is not permitted.

71
Q

What are the DoD requirements for an operational reference monitor?

A

It must be tamperproof
It must always be invoked when a program or user requests access to resources
It must be small enough to be subject to analysis and tests, the completeness of which can be assured.

72
Q

What are the four security modes set out by the “light yellow book”, DoD CSC-STD-003-85?

A

Compartmented security mode
Dedicated security mode
Multilevel security mode
System-high security mode

73
Q

What is compartmented security mode?

A

All users must hve an appropriate clearance to access all information processed by the system, but don’t necessarily have a need to know all the information on the system. The system may process two or more types of compartmented information.

74
Q

What is dedicated security mode?

A

The system is authorized to process only a specific classification level at a time, and all users must have clearance and a need to know that information.

75
Q

What is multilevel security mode?

A

Systems in this mode are authorized to process information atmore than one level of security even when all system users do not have appropriate clearances or a need to know for all information on the system.

76
Q

What is system-high security mode?

A

Systems in this mode are authorized to process only information that all system users are cleared to read and have a valid need to know. Not trusted to maintain separations between security levels. All information must be processed as if it were the same level as the most highly classified information processed by the system.

CISSP (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions