Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chaptet 10 - Software Security > Flashcards

Chaptet 10 - Software Security Flashcards

0
Q

Initiation

A

The first step, the idea, the choosing a vendor vs homebrew, the project level risk assessment .. Will this work?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Software development lifecycle

A 
Initiation
Acquisition
Implementation
Operation/Maintenance
Disposal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Certification vs accreditation

A

Certification is the technical testing

Accreditation is the formal authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Statement of work

A

Outlines the work necessary to work with a customer on a project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Scope creep

A

When the purpose of a project shifts during the processes and additional steps are added

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Work breakdown structure

A

A project management tool used to group sets of activities logically to keep focused

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Privacy risk assessment

A

A software risk assessment to discover vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Privacy impact rating

A

This is the level of impact per item on the privacy risk assessment, generally rated in P1 to P3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What three models of software design are there?

A

Informational
Functional
Behavioral

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Attack surface analysis

A

Aims to reduce the amount of code accessible by untrusted users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Threat modeling

A

Model used to detect threat vectors using a threat analysis tree

Threat analysis and modeling tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Computer aided software engineering CASE

A

Tools like dreamweaver and visual studio

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Where can I find a list of common code vulnerabilities?

A

Cwe.mitre.org/top25/#Listing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Static analysis

A

Automated code review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Unit testing

A

Testing a module or chunk of code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the key components of a test phase?

A

Test needs to mirror production
Pen testing is necessary
Platform testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Testing types

A

Unit testing
Integration testing
Acceptance testing
Regression testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Fuzzing

A

Throwing random data at a solution to see what errors occur in order to detect vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Dynamic analysis

A

Watching the code stream and sub level messages to ensure code is running correctly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Maintenance hook

A

Code that is used for troubleshooting low level code and should be removed in prod

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Verification vs validation

A

Verification determines accuracy to spec

Validation determines of the product solved the intended problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Zero day vulnerability

A

Vulnerability that does not have a fix yet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Wasc

A

Web application security consortium is a web organization that tracks attacks on the Internet

Owasp is the open standard for this

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

ISO 27034

A

Software development guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Build in security

A

A homeland security effort that makes guidelines for software developers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Build and fix model

A

Build and deploy first .. Then fix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Waterfall model

A

Each phase is completed in entirety and cannot be returned to until the process is completed as a whole

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

V-shaped model

A

Similar to waterfall but with testing at each stage that can fall back to previous steps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Rapid prototype

A

A throw away prototype meant to just see it in a action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Evolutionary vs operational prototype

A

A prototype that is not discarded but evolved, operational means it is put into production

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Incremental model

A

Many small waterfalls take place with each phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Spiral model

A

Slow moving security conscientious and risk centric model with evolutionary and operational prototypes in the mix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Rapid application development

A

Demonstrate refine build repeat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Agile model

A

Functional based incremental code that is assembled on the fly and driven by customer requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Exploratory model

A

Specification based development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Joint analysis development

A

Workshop oriented development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Reuse model

A

Taking other functions already made an piecing them together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Clean room development

A

Development that is mostly test based and meant for certification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Capability maturity model integration

A

A maturity model that helps companies work together in development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

CMMI stages

A 
Initial
Repeatable
Defined
Managed
Optimized
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Software configuration manager

A

GitHub like software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Software escrow

A

When software is stored for individuals in a software ‘vault’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Assembly language

A

Uses assemblers to take ADD PUSH POP etc commands and create then into binary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

High level language

A

C is considered a high level language and uses else if and then

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Very high language

A

C++ is a good example of this level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Natural languages

A

C# is a natural language and flows logically and easily

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Generation one language

A

Machine language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Interpreter

A

Used as an intermediary to run bytecode .. Java, flash, powershell, bash are interpreted languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Garbage collection

A

Taking all unused memory cells and giving them back to the OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

OOP

A

Object based language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Method

A

An actionable code that modifies an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Encapsulated code

A

Reusable isolated object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Data hiding

A

Objects can access other objects except through methods

54
Q

Library

A

All needed objects live in one place and exist only once

55
Q

OOA vs OOD structured analysis

A

OOA is analysis and classification OOD is design that modularizes data into objects

56
Q

Data Modeling

A

I input 1 and expect 17 to output, lets test

57
Q

Cohesion

A

High cohesion means that the tasks of a module are limited and of the same limited discipline making it easier to adjust

58
Q

Coupling

A

Modules level of dependency on other modules

59
Q

Data structure

A

A logical representation between elements of data

60
Q

DCOM vs DCE

A

DCOM is Microsoft proprietary distributed computer system that uses GUID, DCE is open and uses universal unique IDs UUID

61
Q

Common Object Request Broker Architecture

A

An open object-oriented uniform standard architecture

62
Q

ORBs

A

System oriented brokers (object request broker)

63
Q

COM vs DCOM

A

Component object model is for local machines, DCOM is distributed to network machines

64
Q

.Net

A

A framework that has replaced COM/DCOM

65
Q

OLE

A

Object linking and embedding enhances COM

66
Q

J2EE

A

Java version of what COM was to Microsoft

67
Q

Service Oriented Architecture (SOA)

A

Web based single destination for service control (automatrix)

68
Q

UDDI, WSDL, and SOAP

A

XML based components that work within SOA

69
Q

Web 2.0

A

An internet in which people could supply content without code, ie Facebook, YouTube, etc

70
Q

Mashup

A

Combining common services together, this is what google did in the 90’s with search engines

71
Q

SaaS

A

Combining software into a SOA and providing a central access

72
Q

Mobile Code

A

Code executed on the client side

73
Q

JVM

A

Runs ‘bytecode’ interpreter on a java virtual machine sandbox on the client end regardless of OS

74
Q

ActiveX

A

Microsoft OOP using a COM/DCOM based sandbox

75
Q

Authenticode

A

Microsoft version of digital signatures implemented into ActiveX

76
Q

Server Side Includes

A

Document that dynamically stores information in a server side .inc file, this can be accessed and code can be learned from this

77
Q

Information Gathering

A

Getting server side includes, DB passwords, error messages and other information from the public connectable code

78
Q

Administrative Interfaces

A

Admin accessible consoles should be far more secure than the web interface that the admin console implements

79
Q

Authentication and Access Control

A

Authentication user/pass should be different per site, secured by SSL, and a strong password and uncommon username

80
Q

Input Validation

A

Ensures the input is within limits and cannot be used to crash or obtain critical data

81
Q

Client Side Validation

A

Works great to reduce server errors and load, but doesnt work out securely if it is the ONLY method being used to validate

82
Q

SQL Injection

A

Input SQL commands into input variables to execute them

83
Q

Cross Site Scripting (XSS)

A

Cross-Site Scripting any code written that can steal cookies, hijack sessions, execute malware or exploit vulnerabilities

84
Q

Parameter validation

A

Validation of system variables people shouldn’t have access to

85
Q

Session Cookie vs Persistent Cookie

A

Session is in memory, persistent is saved to the machine

86
Q

What is the risk of a web proxy?

A

Input can be changed at the proxy on session cookies

87
Q

What is the danger of hidden fields?

A

They can still be found and modified

88
Q

Adequate Parameter Validation

A

Pre-validation of input along with Post-validation

89
Q

Session Management

A

Usually done with Session IDs and should be over HTTPs

90
Q

Replay Attacks

A

Capturing requests and resubmitting them to gain access

91
Q

What are the database models?

A 
Relational - N1 N2 N3
Hierarchical - Subject to Author to Book
Network - Hierarchical with a mesh
Object - Created with OOP trees
Object-relational - OOP front end to a Relational backend
92
Q

What are some client Database Interfaces?

A

ODBC - Open
OLEDB - OLE
ADO - activeX
JDBC - Java

93
Q

Data Definition Language

A

Defines structure and schema of DB

94
Q

Data Dictionary

A

Metadata (data about data) for databases

95
Q

What is the primary method of ensuring integrity in a DB?

A

Database Locking

96
Q

Semantic vs Referential vs Entity Integrity Check

A

Semantic - Rule checking
Referential - Primary/Foreign Key checking
Entity - Every Tuple has a primary key

97
Q

Rollback database

A

Undo changes

98
Q

Commit and Two-Phase commit?

A

Submits changes, two phase verifies all servers are responsive that should be first

99
Q

Aggregation

A

Taking two pieces of information and combining them to draw a secret conclusion

100
Q

Inference

A

The ability to derive information not directly accessible

101
Q

Content vs Context dependent access control

A

Content is based on sensitivity of the data

Context is based on the individual having access to all pieces of the answer before getting part of the pieces

102
Q

Cell Suppression

A

Hiding cells that could be used in inference attacks

103
Q

Partitioning the DB

A

Hides part of the answer here, and another part there

104
Q

Noise and perturbation

A

Adding false data to confuse the message

105
Q

Database Views

A

Used to give security to specific collections of tables and rows (tuples) without duplicate data

106
Q

Polyinstantiation

A

Creating bogus data to throw off legitimate higher data

107
Q

OLTP

A

Used to ensure ALL replications of the data are consistent and verified

108
Q

Data Warehousing

A

Aggregating key elements of multiple databases into one normalized database used for data mining

109
Q

Data mining

A

Mathematical and analytical reporting from a data warehouse

110
Q

Knowledge discovery in Database (KDD)

A

Used to classify and collectively organize data mining

111
Q

Expert Systems

A

AI, machines that can learn like a human brain

112
Q

Rule-based programming

A

Pattern matching to draw up inference in and inference engine

113
Q

Artificial Neural Network

A

Computer aided attempt to recreate the human brain

114
Q

Malware

A

Malicious software

115
Q

Virus

A

A self replicating piece of malware dependent on software

116
Q

Type of Viruses

A

Macro - script in application (like excel)
Boot Sector - on boot, you get hosed
Compression - on decompress, bam
Stealth - hidden by faking filesize or moving contents
Polymorphic - generates noise for the virus scanner
Multipart - infects multiple aspects of a virus
Meme - hoax emails
Script - running .vb or .jar from untrusted
Tunneling - Installs under antivirus so it cannot see it

117
Q

Worm

A

Self-replication application independent virus

118
Q

Rootkit

A

A kit of software making it easier to stay hidden, gather information, and stay accessible by the attacker

119
Q

Spyware

A

Information gathers

120
Q

Adware

A

Advertisement based malware

121
Q

Botnet

A

Bot based attacks commanded by a C&C

122
Q

Command and Control (C&C)

A

Used to centrally manage all bots at the same time, often used for DDOS, but many other applications are feasible

123
Q

Fast Flux

A

Rapidly change DNS on malicious sites to disguise source

124
Q

Logic Bombs

A

“If account disabled, deleted database”

125
Q

Trojan

A

A disguised application, ie. notepad.exe

126
Q

Remote access trojans (rats)

A

A trojan that installs an agent that gives remote access (subseven or back orifice)

127
Q

Signature based antivirus

A

Fingerprint, effective, but there is a ‘long’ delay between when the virus releases and when it is fingerprinted

128
Q

Heuristic antivirus

A

Analyzing code and making assumptions it is malware

129
Q

Static vs Dynamic Analysis

A

Dynamic is running code, static is not

130
Q

Behavior Blocking

A

Allows virus to run, but inhibits ability to function by taking away OS functionality

131
Q

Immunizer

A

Makes a particular functionality look infected, to fool the virus

132
Q

Bayesian filtering

A

Mathematical logic used to detect patterns

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions