CISSP (Domain 4 - Software Development Security) Flashcards
1
Q
Waterfall Method
A
- Traditional model
- Completion of one task goes to another
- Long term projects
2
Q
Prototyping Method
A
- Address time issues with waterfall
- Evolves each round
- Four Phases
+ initial concept, implement pt, refine, release
3
Q
Spiral Model
A
- Combination of waterfall and prototyping
- Develop initial with PT then each with Waterfall
4
Q
Software Development Life Cycle (SDLC) (7 things)
PI/FD/SD/SD/ITI/OM/D
A
- Project initiation
- Functional design analysis and planning
- System design specifications
- Software development
- Installation/Test/Implementation
- Operational/Maintenance
- Disposal
5
Q
Project Initiation - SDLC
A
Identify security requirements
6
Q
Functional Design - SDLC
A
Function to address the threat
7
Q
System Design - SDLC
A
What security technology will be used
8
Q
Software Development - SDLC
A
Write code to meet specifications
9
Q
Testing and Installation - SDLC
A
Test system components, create manuals, UAT
10
Q
Operations/Maintenance - SDLC
A
Maintain system through SLA
11
Q
Disposal - SDLC
A
Data moved to another system or discarded
12
Q
Verification
A
Test features for functionality
13
Q
Validation
A
Test system as a whole
14
Q
Computer Aided Software Engineering (CASE)
A
Tools used to help programmers/PM/Analyst for automation, debugging, and rapid prototyping
15
Q
Capability Maturity Model (5 levels)
IRDMO
A
Used to improve processes which improves output
- Initiating
- Repeatable
- Defined
- Managed
- Optimizing
16
Q
Initiating - CMM
A
Processes are disorganized, ad-hoc processes
17
Q
Repeatable - CMM
A
Processes made, established, defined, and documented
18
Q
Defined - CMM
A
Know the date it will be done
19
Q
Managed - CMM
A
% measurements of completion
20
Q
Optimizing - CMM
A
Constant process improvement
21
Q
Object Oriented Programming
A
- Closely maps to real activities in the business world
- Highly modular
- Self contained
22
Q
Classes
A
Define attributes and characteristics of the possible objects within them
23
Q
Objects
A
Software entities that are grouped into Classes
24
Q
Polymorphism
A
Two objects sent the same message but react differently.
Same input different output with different object in same class.
25
Polyinstantiation
Creation of another version of an object using different values for its variables to ensure lower level subjects do not access data at higher classification.
Data masking
26
Cohesive - Module Interaction
Perform single task with little help from other modules
27
Coupling - Module Interaction
Measurement of interaction between objects. Modules should not affect each other drastically.
28
Meta-Data
- Data about data
| - Data used to describe the database and the data within it
29
Open Database Connectivity (ODBC)
Manager between the application and the database's.
30
Data Warehousing
Combine data from multiple databases into a large database for information retrieval and data analysis
31
Data Mining
Process of analyzing a database using tools that look for trends or anomalies without having the knowledge of the meaning of the data.
Massage data to be more meaningful
32
Database ACID Test
- Atomicity: Either all changes take effect or none do
- Consistency: A transaction is allowed if it follows constraints
- Isolation: The result of the transaction are not visible until the transaction is complete
- Durability: Results of a completed transaction are permanent
*Maintain integrity of DB
33
Aggregation - DB Security Attack
Act of combining information from separate sources to form new information for which attacker does not have access to
34
Inference - DB Security Attack
Ability to derive additional information from learned facts about a particular system.
Lower security level indirectly portrays data at a higher level.
*Fought with Polyinstantiation
35
Enterprise Java Bean (EJB) - Distributed Communication Standard
Intended to handle common concerns with persistence, transactional integrity, security in a standard way.
*Programmers can concentrate on object at hand
36
Simple Object Access Protocol (SOAP) - Distributed Communication Standard
Replacement for DCOM and uses XML-based communication
37
Distributed Component Object Model (DCOM)
Allows for objects on different systems to interact
38
Common Object Model (COM)
Allow for simple inter-process communication between objects
39
Object Linking and Embedding (OLE)
Provides a way for objects to be shared on a local workstation and uses COM as its foundation base
*Embedding an image in a document
40
Cross Site Scripting (XSS)
Client makes request to web server. Web server is compromised to throw a popup with the contents of an attackers site
41
5 Types of Malware
| VMLTO
- Virus
- Worm
- Logic Bomb
- Trojan Horse
- Other Attack Types
42
Malicious Code Detection
- *File integrity checker (checksum)
- File size increases
- Many unexpected disk access
43
Virus
* Needs a delivery vehicle
| - Program that searches out other programs and infects them by embedding a copy of itself
44
Macro Virus
Written in macro language that is platform independent.
Programs run automatically when document is opened
45
Compression Virus
Appends itself to executable's on the system and compresses them by using the users permissions
46
Stealth Virus
Hides modifications it has made and tricks anti-virus software by intercepting its requests to the OS and provides bogus information
47
Polymorphic Virus
*Digital signature changes
Produces varied by operational copies of itself. (nothing identical)
48
Multi-Partite Virus
Infects computer in multiple ways
- Boot sector
- Hard Drive
49
Self-Garbling Virus
Attempts to hide from anti-virus software by modifying its own code so it doesn't match predefined signatures
50
Meme Virus
E-mail messages that are continually forwarded around the internet. Not a virus
51
Worms
- Can reproduce on their own
- Self contained code
*Own mind
52
Logic Bomb
An event triggers on a certain date/time
53
Trojan Horse
Program disguised as another program and does stuff in backgroun
54
Smurf Attack
Uses IP spoofing and ICMP replies in order to saturate a host
1. Spoofed IP (SRC Masked)
2. ICMP echo to broadcast destination (DST)
3. Bounced response (DST to SRC Masked IP)
55
Fraggle Attack
Uses IP spoofing and UDP replies in order to saturate a host
1. Spoofed IP (SRC Masked)
2. UDP to broadcast destination (DST)
3. Bounced response (DST to SRC Masked IP)
56
Stop Smurf Attacks (Internal/Target/Bounce)
Internal:
- Only let traffic from our own network out (SRC was masked)
Target:
- Block no ICMP from outside
Bounce Site:
- Block ICMP and Broadcast
57
Zombies
Computers that make up botnet community
58
Ingress Filtering - DDoS Countermeasure
Do not allow packets in with internal source addresses
59
Egress Filtering - DDoS Countermeasures
Do not allow packets to leave with external source addresses
60
Expert Systems - AI
- Computer users KB, algorithms, and rules
- Infer new facts from existing knowledge and incoming data
- Heuristic obtained through experiences and learning
- App
61
Inference Engine - AI
- Rule based programming
| - If/Then logic
62
Artificial Neural Networks (ANN)
- The ability to remember and learn from new experiences
- Capacity to generalize
- Only good for the experience they are given
63
Online Transaction Processing (OLTP)
Mechanisms that watch for problems and deal with them appropriately when they occur.
*Ensure transactions go properly
