CISSP (Domain 4 - Software Development Security) Flashcards
Waterfall Method
- Traditional model
- Completion of one task goes to another
- Long term projects
Prototyping Method
- Address time issues with waterfall
- Evolves each round
- Four Phases
+ initial concept, implement pt, refine, release
Spiral Model
- Combination of waterfall and prototyping
- Develop initial with PT then each with Waterfall
Software Development Life Cycle (SDLC) (7 things)
PI/FD/SD/SD/ITI/OM/D
- Project initiation
- Functional design analysis and planning
- System design specifications
- Software development
- Installation/Test/Implementation
- Operational/Maintenance
- Disposal
Project Initiation - SDLC
Identify security requirements
Functional Design - SDLC
Function to address the threat
System Design - SDLC
What security technology will be used
Software Development - SDLC
Write code to meet specifications
Testing and Installation - SDLC
Test system components, create manuals, UAT
Operations/Maintenance - SDLC
Maintain system through SLA
Disposal - SDLC
Data moved to another system or discarded
Verification
Test features for functionality
Validation
Test system as a whole
Computer Aided Software Engineering (CASE)
Tools used to help programmers/PM/Analyst for automation, debugging, and rapid prototyping
Capability Maturity Model (5 levels)
IRDMO
Used to improve processes which improves output
- Initiating
- Repeatable
- Defined
- Managed
- Optimizing
Initiating - CMM
Processes are disorganized, ad-hoc processes
Repeatable - CMM
Processes made, established, defined, and documented
Defined - CMM
Know the date it will be done
Managed - CMM
% measurements of completion
Optimizing - CMM
Constant process improvement
Object Oriented Programming
- Closely maps to real activities in the business world
- Highly modular
- Self contained
Classes
Define attributes and characteristics of the possible objects within them
Objects
Software entities that are grouped into Classes
Polymorphism
Two objects sent the same message but react differently.
Same input different output with different object in same class.
Polyinstantiation
Creation of another version of an object using different values for its variables to ensure lower level subjects do not access data at higher classification.
Data masking
Cohesive - Module Interaction
Perform single task with little help from other modules
Coupling - Module Interaction
Measurement of interaction between objects. Modules should not affect each other drastically.
Meta-Data
- Data about data
- Data used to describe the database and the data within it
Open Database Connectivity (ODBC)
Manager between the application and the database’s.
Data Warehousing
Combine data from multiple databases into a large database for information retrieval and data analysis
Data Mining
Process of analyzing a database using tools that look for trends or anomalies without having the knowledge of the meaning of the data.
Massage data to be more meaningful
Database ACID Test
- Atomicity: Either all changes take effect or none do
- Consistency: A transaction is allowed if it follows constraints
- Isolation: The result of the transaction are not visible until the transaction is complete
- Durability: Results of a completed transaction are permanent
*Maintain integrity of DB
Aggregation - DB Security Attack
Act of combining information from separate sources to form new information for which attacker does not have access to
Inference - DB Security Attack
Ability to derive additional information from learned facts about a particular system.
Lower security level indirectly portrays data at a higher level.
*Fought with Polyinstantiation
Enterprise Java Bean (EJB) - Distributed Communication Standard
Intended to handle common concerns with persistence, transactional integrity, security in a standard way.
*Programmers can concentrate on object at hand
Simple Object Access Protocol (SOAP) - Distributed Communication Standard
Replacement for DCOM and uses XML-based communication
Distributed Component Object Model (DCOM)
Allows for objects on different systems to interact
Common Object Model (COM)
Allow for simple inter-process communication between objects
Object Linking and Embedding (OLE)
Provides a way for objects to be shared on a local workstation and uses COM as its foundation base
*Embedding an image in a document
Cross Site Scripting (XSS)
Client makes request to web server. Web server is compromised to throw a popup with the contents of an attackers site
5 Types of Malware
VMLTO
- Virus
- Worm
- Logic Bomb
- Trojan Horse
- Other Attack Types
Malicious Code Detection
- *File integrity checker (checksum)
- File size increases
- Many unexpected disk access
Virus
- Needs a delivery vehicle
- Program that searches out other programs and infects them by embedding a copy of itself
Macro Virus
Written in macro language that is platform independent.
Programs run automatically when document is opened
Compression Virus
Appends itself to executable’s on the system and compresses them by using the users permissions
Stealth Virus
Hides modifications it has made and tricks anti-virus software by intercepting its requests to the OS and provides bogus information
Polymorphic Virus
*Digital signature changes
Produces varied by operational copies of itself. (nothing identical)
Multi-Partite Virus
Infects computer in multiple ways
- Boot sector
- Hard Drive
Self-Garbling Virus
Attempts to hide from anti-virus software by modifying its own code so it doesn’t match predefined signatures
Meme Virus
E-mail messages that are continually forwarded around the internet. Not a virus
Worms
- Can reproduce on their own
- Self contained code
*Own mind
Logic Bomb
An event triggers on a certain date/time
Trojan Horse
Program disguised as another program and does stuff in backgroun
Smurf Attack
Uses IP spoofing and ICMP replies in order to saturate a host
- Spoofed IP (SRC Masked)
- ICMP echo to broadcast destination (DST)
- Bounced response (DST to SRC Masked IP)
Fraggle Attack
Uses IP spoofing and UDP replies in order to saturate a host
- Spoofed IP (SRC Masked)
- UDP to broadcast destination (DST)
- Bounced response (DST to SRC Masked IP)
Stop Smurf Attacks (Internal/Target/Bounce)
Internal:
- Only let traffic from our own network out (SRC was masked)
Target:
- Block no ICMP from outside
Bounce Site:
- Block ICMP and Broadcast
Zombies
Computers that make up botnet community
Ingress Filtering - DDoS Countermeasure
Do not allow packets in with internal source addresses
Egress Filtering - DDoS Countermeasures
Do not allow packets to leave with external source addresses
Expert Systems - AI
- Computer users KB, algorithms, and rules
- Infer new facts from existing knowledge and incoming data
- Heuristic obtained through experiences and learning
- App
Inference Engine - AI
- Rule based programming
- If/Then logic
Artificial Neural Networks (ANN)
- The ability to remember and learn from new experiences
- Capacity to generalize
- Only good for the experience they are given
Online Transaction Processing (OLTP)
Mechanisms that watch for problems and deal with them appropriately when they occur.
*Ensure transactions go properly
