DEV Flashcards
set of best practices for programmers to seek in all application or database design: Atomicity, Consistency, Isolation, Durability
ACID test
Authenticode, relies on digital signatures, annoying dialogs people click away
Active X
a library of commands maintained by a system for other programs to use, provides consistency and integrity for the programs
Application Programming Interface
is the tool that converts a high level language into machine language
Assembler
Converts machine-code into binary machine instructions. Translate assembly language into machine language.
Assembler - DEV
low-level programming language with a few simple operations this code is harder to maintain, less readable, and has the potential to be substantially longer
Assembly Code
indivisible, data field must contain only one value that either all transactions take place or none do
Atomicity
Program installed by an attacker to enable him to come back on a later date without going through the proper authorization channels, maintenance hook for developers sometimes
Backdoor
Results exhibited by an object in response to a msg
Behavior
Most significant byte is stored first. SPARC uses this architecture.
Big Endian
When a Windows system experiences a dangerous failure and enters a full secure state (reboot)
Blue Screen of Death
Moves or overwrites the boot sector with the virus code
Boot sector
Attacks the MBR - the portion of bootable media that the computer uses to load the operating system during the boot process. MBR viruses store the majority of their code on another portion of the storage media
boot sector infector
organized group of compromised computers
Botnet
an area of memory allocated with a fixed size. It is commonly used as a temporary holding zone when data is transferred between two devices that are not operating at the same speed or workload.
Buffer
Occurs when an area that has been allocated a specific storage space has more data copied to it than it can handle. Two classes include heap and stack overflow.
Buffer Overflow
program code that is in between the high level language code understood by humans and machine code read by computers.
Byte Code
An attribute that is a unique identifier within a given table, one is chosen to be the primary and the others are alternate. Subset of attributes that can be used to uniquely identify any record in a table. No two records in the same table will ever contain the same values for all attributes. Each table may have one or more, which are chosen from column headings.
Candidate Key
Tool for development, if concerned about security
CASE
a business managers and software engineer’s process to protect the organization from development-related issues. Has three components: Request, Change, and Release Control
Change Management Process
part of a transaction control for a database which informs the database of the last recorded transaction
Checkpoint
OOP concept of a template that consist of attributes and behaviors
Class
converts source code to an executable
compiler
Write code correctly first time, quality thru design
Cleanroom
Is an opposing coding stance that keeps source code confidential. Can be reverse engineered or decompiled
Closed source
Is one that is proprietary with no third-party product support, does not define if it’s code can be viewed
Closed system
Peer-driven process that includes multiple developers, may be automated, may review several hundred lines an hour, done after it’s developed
Code Review
Ability to perform without use of other programs, strength of the relationship between the purposes of methods within the same class
Cohesion
Support exchange of objects amongst programs. This used to be called OLE. DCOM is the network variant (distributed)
COM, Common Object Model
infected code is stored not in the host program, but in a separate files. Takes advantage of search order of an OS
Companion virus
converts source code to an executable
Compiler
Translates higher level program into an executable file
Complier - DEV
Appended to executables
Compression
Periodic, should be conducted to ensure that the actual production environment is consistent with the accounting records and that no unauthorized changes have taken place.
Configuration Audit
Ensures that changes to software versions are made in accordance with policies. Updates can be made only from authorized distributions in accordance with those policies.
Configuration Control
Administrators document covered software products throughout the organization.
Configuration Identification
Used to control the version( s) of software used throughout an organization and formally track and control changes
Configuration Management Process
property that data is represented in the same manner at all times
Consistency
Broker architecture enables programs written in different languages and using different platforms and OS’s through IDL (Interface Definition Language)
CORBA, Common object request
Effect on other modules. Level of interaction between objects
Coupling
Is a way to receive information in an unauthorized manner, information flood that is not protected by a security mechanism
Covert channels
Processes communicate via storage space on the system; Writing to storage by one process and reading by another of lower security level.
Covert Storage Channel
One process relays to another by modulating its use of system resources. Typing rhythm of Morse Code is an example
Covert timing channel
malware that uses the trust on a website to redirect users to untrusted websites which captures data or installs more malware
Cross Site Scripting
attacks exploit the trust that sites have in a user’s browser by attempting to force the submission of authenticated request to third-party sites.
CSRF (XSRF)
Cross Site Request Forgery
false memory reference
Dangling pointer
a description of a database
Data Dictionary
malware that makes small random changes to many data points
Data Diddler
a feature of object oriented programming languages. Classes and variables may be marked private, which restricts outside access to the internal workings of a class.
Data Hiding
small data warehouse
Data marts
specifies the way data will be stored in memory
Data Type
z-Mixing data with different classification levels and/ or need-to-know requirements and is a significant security challenge. Often, administrators will deploy a trusted front end to add multilevel security to a legacy or insecure DBMS
Database Contamination
Process of splitting a single database into multiple parts, each with a unique and distinct security level or type of content
Database Partitioning
a copy of transaction data, designed for querying and reporting
Data warehouse
a collection of information designed to reduce duplication and increase integrity
Databases
Schemas, blueprints; tables, views
DB main components
Refers to a suite of software programs that maintains and provides controlled access to data components stored in rows and columns of a table
DBMS
subset of SQL used to control access to data in a database, using GRANT and REVOKE statements
DCL - Data Control Language
enables applications to work in a client/server model by providing the inter-process communications mechanism (IPC)
DDE - Dynamic Data Exchange
defines structure and schema
DDL - Data Definition Language
a condition in which neither party is willing to stop their activity for the other to complete
Deadlock
Forwarding a request to another object
Delegation
an availability attack, to consume resources to the point of exhaustion
Denial of Service
a combination of Development and Operations, symbolizing that these functions must merge and cooperate to meet business requirements
DevOps
Attempt to force the web application to navigate up the file hierarchy and retrieve a file that should not normally be provided to a web user
Directory Traversal Attack
When one transaction reads a value from a Db that was written by another transaction that did not commit, Db concurrency issue
Dirty Reads
software tool is used to convert compiled programs in machine code to assembly code
Disassembler
an availability attack, to consume resources to the point of exhaustion from multiple vectors
Distributed Denial of Service
view, control and use the database via VIEW, ADD, MODIFY, SORT and DELETE commands
DML - Data Manipulation Language
what is will remain, persistence
Durability
Created on the fly by software in an Object Oriented Programming environment. Preassembled code that is a self-contained module
Dynamic Lifetime Objects
a programming component that runs on Win32 systems and contains functionality that is used by many other programs
DLL - Dynamic Link Library
a feature of object-oriented programming, provides a logical structure to a program and allows for easy methods of inheritance
Encapsulation
Seek to embody accumulated knowledge on a particular subject and apply it in a consistent fashion to future decisions. Has two main components: the knowledge base and the inference engine.
Expert Systems
causes a software vulnerability to be triggered and leveraged by the attacker
Exploit
Allow programmers to create code using visual interfaces
Fifth-Generation Languages (5GL)
Include all machine languages
First-Generation Languages (1GL)
Represents a reference to an entry in some other table that is a primary key there. Link between the foreign and primary keys represents the relationship between the tuples. Enforces referential integrity Main Components of a Db using Db - Schemas; blueprints - tables - views
Foreign Key
Attempt to approximate natural languages and include SQL, which is used by databases
Fourth-Generation Languages (4GL)
a miniature program
Function
Define need, requirements, review proposed security controls
Functional Analysis and Planning
Bar type; shows the interrelationships over time between projects and schedules. Graphical illustration of a schedule that helps plan, coordinate, and track specific project tasks. WBS a subpart
Gantt Chart
Is similar to process isolation in purpose. Difference is this enforces these requirements through the use of physical hardware controls rather than the logical process isolation controls imposed by an operating system
Hardware segmentation
an area of memory utilized by an application and is allocated dynamically at runtime. Static variables are stored on the stack along with data allocated using the malloc interface.
Heap
Behavioral can detect new malware
Heuristic ANTI-Virus
Module largely affects many more modules
High coupling
False warnings
HOAXES
Single patch, patches provide updates to operating systems and applications
Hotfix, update, Security fix
uncheck data input which results in redirection
HTTP Response Splitting
When one transaction is using an aggregate function to summarize data stored in a Db while a second transaction is making modifications to a Db, causing incorrect information
Incorrect Summaries
to jump to a conclusion
Inference
object-oriented organization and encapsulation allow programmers to easily reuse previously written code. It saves time since programmers do not have to recode previously implemented functionality.
Inheritance
OOP concept of an object at runtime
Instance
in the case of unsigned values, this occurs when an overly large unsigned value is sent to an application that “passes” the integer back to zero or a small number
Integer Wrapping
line by line translation from a high level language to machine code
Interpreter
Reads higher level code, one line at the time to produce machine instructions
Interpreter - DEV
another subject cannot see an ongoing or pending update until it is complete
Isolation
modern, object oriented programming language. It combines a similar syntax to C and C++ with features such as platform independence and automatic garbage collection.
Java
Interpreted language that does not make use of a complier to transform code into an executable state. Java, C, and C++ are all compiled languages
JavaScript
Used by processor to execute instructions from OS
Kernel Mode
Implement a structure similar to the ring model used for operating modes and apply it to each operating system process
Layering processes
the least significant byte is stored first
Little Endian
a program that waits for a condition or time to occur that executes an inappropriate activity
Logic bomb
Executes when a certain event happens (like accessing a bank account or employee being fired) or a data/time occurs
Logic Bomb/Code Bomb
Tool used for covert channel that writes data directly after the ICMP header
LOKI
When one transaction writes a value to the Db that overwrites a value needed by transactions that have earlier precedence
Lost Updates
the hardware address of a particular computer system
MAC
program instructions based upon the CPU’s specific architecture
Machine language
Most common in office productivity documents .doc/.docx
Macro Virus
inappropriate data
Malformed input
a function call dynamically allocates n number of bytes on the heap. Many vulnerabilities are associated with the way this data is handled.
malloc
Bombing, strikes, toxin spills
Man-made Threats
Software solution to manage the myriad mobile devices that employees use to access company resources. Goals are to improve security, provide monitoring, enable remote management, and support troubleshooting
MDM - Mobile device management
