Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 8: Software Development Security > Flashcards

Chapter 8: Software Development Security Flashcards

1
Q

Abstraction

A

Information Hiding - focus on big picture….

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

aggregation

A

pulling bits of different data together then make an assumption via inference…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Agile Model

A

most common

very flexible in nature

requirements to change throughout. good for when projects requirements change a lot.

Pros:

  • fewer defects
  • greater flexibility
  • immediate feedback

cons:

  • Less Documentaion
  • Less focus on system design.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Atomicity

A

A transaction is fully complete or it is rolled back All or Nuthin looking for the “commit message”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Attributes - Object Oriented Technology

A

Descriptors for each class

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

auditing

A

create audit policy to track actions to a subject.

audits can be use to :

  • ensure policies are being followed/are effective
  • marke sure hat individual user accounts aren’t unntentinoally being allowed to accumulate rights/permissions.
  • check the accuracty and completeness of transactions that are authorized
  • privileged actions are restriced to authorized personnnel.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Backdoor

A

Usually created by software developers for an emergency entry into a system. Example may be a hotkey in the event that a password is not available for access. Obviously can be used by anyone with such knowledge to gain access into the system. A trapdoor is rather created via malicious activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

brocken auth & session mgmt

A

applications fuctions related to authentication and session managment are often no implemented correctly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Capability Maturity Model Integrated - CMMI

A

from carnegie mellon an organization’s project management’s process can be ranked on their maturity and can be ranked 5 levels. 5 best most orgs want a level3 “i really don’t mind oranges” 5 levels: Initial-caotic and heroic effort Repeatable- trying to get processes going…time, scop Defined: Project management office Managed- good understanding of process and product Optimized - associated with Kiazen, CPI continue process improvent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cardinality

A

the number of rows in a relation one to many (such as customer to orders made)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CGI

A

common gateway interface

does the input validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Classes - Object Oriented Technology

A

Defines attributes, characteristics, and behaviors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Code Injection

A

Looking at language of database and issuing commands.

Entering malicous code into webforms. no brackets, drop-table..input validation

make sure no data control language entered.

data type… only specific data

drop downs etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Cohesion

A

Singleness of purpose - you want HIGH cohesion both have H’s :)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Consitencey

A

Enforce any rules that are system defined or Administrator define

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Coupling

A

the dependency between modules - sharing same code for other apps. LOOSE coupling both have L’s in them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CSRF

A

Cros site request forgery

takes advantage of a webite’s trust in a user

two sessions going on across user’s computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Data Marts

A

Often regional collection of info from database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data Mining

A

process of pulling info from data warehouse by utilizing meta-data. police mining info about perps…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Warehouse

A

collection of information from data marts….think of meth..example.. law enforments pull mull all store info into warehouse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Database Design - ACID test

A

Atomicity Consistency Isolation Durability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DB Aggregation & Inference

A

a way of gathering information and coming to a conclusion based on that. code injection is only computer based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Degree

A

the number of columns in a relation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Distributes Databases

A

Client-server type of DB located on more than one server distributed in several locations Synchronization accomplished via a two-phase commit or replication methods Data accessible in a single search function despite separate location DNS Data Base Is an example

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Due Diligence

A

is reseach

due care is action… enact policies etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Durability

A

You can’t roll back a transaction you got to start over

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

elite

A

high level database peeps…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Entity Integrity

A

Primary Key field can’t be null

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Foreign Key

A

Primary key from one table appears in a secondary table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Hacker

A

Someone that is very good with computers…

white hat hackers - PEN testers

black hat - ill intent

grey hat - in the middle…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Hierarchical Database

A

Stores related info in a tree-like fashion. Info traced from major group to sub-group Predetermined access paths to data data traced through parents (hierarchy) “inverted tree”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Inference

A

making assumptions from the aggregated info

33
Q

Inheritance - Object Oriented Technology

A

Objects inherit attributes and behaviors from super class

34
Q

IPv6

A

128 bits

Hexidecimal

NAT has make lack of IP’s not as big as a deal…

ipv4 is unsecured…

using as example as talking about unsecure software… lack of security integration.. etc.

35
Q

Isolation

A

until commit message is received the transaction is invisible

36
Q

masking

A

blocking out sensitive information…

37
Q

Messages - Object Oriented Technology

A

means of communication by objects

38
Q

metadata

A

“data about data” like controlled substance purchase

39
Q

Methods - Object Oriented Technology

A

functionality performed by objects

40
Q

Monitoring the program

A

Consistency: results are the same data

Quantative: precise, objective, numberic values

Objectivity: unbiased

Reveleance- shoudl have a direct bearing on a desision

inexpensive: should be cost effective.

41
Q

NFC

A

Near field communications

like the hotel key cards.

42
Q

Normalization of Database

A

no duplicates- every table describes the primary key

43
Q

Object Oriented Database

A

Modular and re-useable by design (probably not testable)

44
Q

Objects - Object Oriented Technology

A

collection of attributes for a single instance

45
Q

OWASP

A

Open web application security project

publish to 10 list of most commonly orchestrated attacks

international non-profit

46
Q

Polyinstantiation

A

to Lie….multiple instances of an event.

Provide false info to people that don’t have clearance. bogus info at lower levels

making the information boring though lying… ;)

47
Q

Polymorphism

A

capability of different objects to respond differently to same message

48
Q

Primary Key

A

the unique identifier that ties all the tables together ie: customer number

49
Q

Prototyping Software Approach

A

Pros:

feedback directly from users

client and contactor can work very closely

also allow software engineer some insight into the accuracy of initial project estimates and wether the deadlines and milestones can be met sucessfully.

cons:

clients rarely understand all teh ramifications of proposed changes.

50
Q

Referential Integrity

A

Can reference a non-existing key

51
Q

Relational Database

A

uses tables ie: columns and rows. A DB in the form of tables (rows & columns) related to each other Stores data in such a way that a data manipulation language can be used independently on data Uses a database engine (Oracle, Sybase, etc.)

52
Q

RFID

A

Radio Frequecy ID like fast pass

credit cars passports…

53
Q

rich internet apps

client side threats

2 of them

A

cross side scripting

xss - attacker takes advantage of website that doesn’t provide validation - code injection

“takes advantage of user’s trust of website”

CSRF

Cross site request forgery attack

take advantage of two session going on at two times…messaging with attacker. bof a account has been compromised….etc. help to troubleshoot problems…steal that session info..

“takes advantage of a website’s trust in a user”

54
Q

Rootkits

A

Malicious code that is intended to take full or partial control of a system at the lowest level (core or kernel). They often hide themselves from monitoring or detection and modify system files. Most rootkit infections install back trapdoors, spyware, or other malicious codes once they gain control of the target system.

55
Q

Script Kiddies

A

someone that has no real talent but can copy and paste borrowed code… deragatory term…

Still pose a threat… don’t understand ramifications…

56
Q

Service Oriented Architechture

A

SOE is an architecture and a vision on how heterogeneous application should be developed and inegrated in the enterprise

share a formal contract

loosely coupled abstraction composable

reusable

autonomous

standard operating stuff…

57
Q

Spiral Software Approach

A

combo of waterfall :stepping + circular nature of prototyping = spiral dev.

Pros:

High amount of risk analysis

good for large and mission critical projects

software is produced early in software life cycle.

Cons:

can be costly

risk analysis requires specific expertise

project’s success is highly dependent of the risk analysis phase.

not for smaller projects.

58
Q

trojan horse

A

Malicious code that masquerades as a harmless file. It usually performs a variety of actions, including key-logging, opening the computer to further attacks, destroying data or files, among others.

59
Q

Tuples

A

Rows…across in relational databases

60
Q

virus

A

spreads from computer to computer via attaching itself to other file…requires user input

61
Q

Waterfall Software Dev. Approach

A

a phased based approach

one step after another..

better for shorter lived projects.

Pros:

  • each phase specific deliverables
  • phases are processed and competed one at a time.
  • best for small projects
  • it reinfoces “define before design” and “design before code.

Cons:

  • Adjusting scope during life cycle can kill a project
  • no working software until late in the gem
  • high risk, uncerainty
  • poor model for long and ongoin projects
  • poor model high probability of chance.
62
Q

Why is software unsecure

A

lack of training

lack of funding

no priortiztion of security

security as afterthought

63
Q

Worms

A

malicious code that spread around a network on its own. self-replicating

64
Q

XSS

A

takes advantage of trust of a website

cross site scripting…

not good input validation…

allows attacker to exectue scrips in the victim’s browser which can hijack user’s sessions.

65
Q

Insecure direct object references

A

defined as an authorized user or process which can invoke the internal functionality of the software by manipulating parameters and other object vales that directly refernce this functionality resulting it problems…

66
Q

sensitve data exposure

A

owasp 6

http vs https…etc.

67
Q

missing function level access control

A

changing parameters in url to gain access to information u should have access to.

68
Q

owasp 9 known vulnerablity component usage

A

components such as libraries frameworks and other software modules, almost alway run with full software priveleges.

don’t use old crappy code..

69
Q

owasp 10

A

unvalidated redirects and fowards

make sure we’re redirected in valid mannar…

70
Q
A
71
Q

Defensive coding

A

proactive, secure coding intended to ensure the continueing function the softwarer under unforseen cicumstances:

Examples:

Input validation

Sanitization - more generic info for example/output sanitization

error handling - non verbose

safe API’s

concurrency - use file lockimg

tokenizing- replace sensitve data with unique id’s.

sandboxing apps.

anti-tampering- code signing/obfuscation

versioning

code analysis/code review

72
Q

Change Management

A

changes must be controlled there has to be a process.

should happen in a stuctural way.

make sure everything is documented..

73
Q

whitebox/clearbox testing

A

test has access to all the code.

74
Q

blackbox testing

A

Zero knowlege attack.

75
Q

fuzzing

A

fault injection to see if anything is successful

brute force of testing ….. challenges input validation.

buffer overflow error…etc.

76
Q

scanning

A

passive

map the enviornment

ident. server verions open ports and running services.

types:

Vulnerability scan

Content Scan

Privacy Scan - to detect privacy violations..

77
Q

Database Models

A
  1. hierarchical - top down
  2. distributed - DNS no single server
  3. object oriented - re-usable and modular in nature.
  4. relational database - sql, oracle, table/fields..etc.
78
Q

what condition is necessary on a web page for it to be used for a cross site scriptign attack

A

reflected-input

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions