Domain 8 Flashcards
Acceptance
A formal, structured hand-over of the finished software system to the customer organization; typically involves test, analysis and assessment activities.
Accreditation (also Security Accreditation)
Formal declaration by a designated accrediting authority (DAA) that an information system is approved to operate at an acceptable level of risk, based on the implementation of an approved set of technical, managerial and procedural safeguards.
ACID Test
Data integrity provided by means of enforcing atomicity, consistency, isolation and durability policies.
Advanced Persistent Threats (APTs)
An agent or organization of agents that plans, organizes and carries out a highly sophisticated attack against a target person, organization or industry over a period of months or possibly even years (thus “persistent”). APTs usually have a strategic goal in mind, which requires many steps in a concerted attack plan to achieve. The term APT may refer to the organization conducting the attack, to specific steps in such an attack as observed by a target or the entire attack sequence. An APT usually involves a phased set of activities, each of which may use dozens of different attack vectors in sequence or in tandem.
Aggregation
The ability to combine non-sensitive data from separate sources to create sensitive information.
Agile Development
Agile development focuses on small team environments and focuses on collaborative, iterative learning, building, testing and deployment of capabilities to operational use. Agile is used to address the need for rapid software development and deployment cycles, perhaps many cycles per day. Agile development follows patterns of activities such as “scrum,” “sprint” or “safe” to manage change and develop and deploy working, reliable and verifiable function.
Application Programming Interfaces (APIs)
Mobile code mechanisms that provide ways for applications to share data, methods or functions over a network. Usually implemented either in XML or JavaScript Object Notation (JSON). A reference to a software access point or library function with a well-defined syntax and well-defined functionality.
Arbitrary Code
Alternate sets of instructions and data that an attacker attempts to trick a processor into executing.
Blocked and Allowed Lists (software, identities, addresses)
Use of lists of blocked or allowed identities—whether as users, URLs, URIs, web addresses, IP addresses, geographic regions, hardware addresses, files or programs—as a means of controlling (prohibiting or permitting) personnel if the attempt involves a resource not on a pre-approved list. Stand-alone security tools and integrated systems that provide these capabilities are now starting to incorporate anti-malware processes as part of their offerings; similarly, anti- malware products have begun to incorporate these blocked/allowed list management and use capabilities. their access, use or attempt to load and execute. These systems also alert designated IT security. In this course, the term “blocked list” replaces “blacklist” and the term “allowed list” replaces “whitelist.”
Botnets
A network of automated systems or processes (robots, or for short, bots) performing a specific function together, usually malicious. Botnets have greatly magnified the power and speed of malicious operations because they all work together toward achieving a malicious goal, and they have allowed for tuning and directing of operations in a way that was not possible with malicious programs in the past.
Bots
An emerging and special class of mobile code. These employ limited machine- learning capabilities to assist with user requests for help or assistance, automation of or assistance with workflows, data input quality validation and other similar tasks.
Buffer Overflow
A source code vulnerability, which allows attempts to access data locations outside of the storage space to be allocated to the buffer. It can be triggered by attempting to input data that is larger than the input buffer being used.
Bypass Attack
Users may attempt to bypass controls at the front end of the database application to access information.
Certification
The comprehensive technical security analysis of the system to ensure that it meets all applicable security requirements.
Citizen Programmers
Members of the organization who codify work-related knowledge, insights and ideas into varying degrees of reusable software- like forms, often using extensibility features found in most commercial software apps. The very ad hoc nature of these pieces of functionality is extremely difficult to manage, control, verify or assess. In almost all cases, these are beyond the reach and visibility of the organization’s software quality, configuration management or security assessment processes. Such “citizen programming” is often done with little regard to security requirements and can pose a significant risk to some organizations.
Code Protection or Logic Hiding
Prevents one software unit from reading or altering the source, intermediate or executable code of another software unit.
Code Reuse
When programmers reuse, rather than reinvent, units of software (procedures or objects) that have already been demonstrated to be correct, complete, safe and secure.
Commercial Off- the-Shelf (COTS)
Software elements, usually applications, that are provided as finished products not intended for alteration by the end user. Most COTS applications are available as host-based, endpoint-based or platform- based services, and support user extensibility by means of non-programming tools, scripts, macros and configuration parameters. COTS can also include firmware and hardware elements.
Common Object Request Broker Architecture (CORBA)
A set of standards that addresses the need for interoperability between hardware and software products residing on different machines across a network. CORBA provides for object location and use across a network.
Configuration Control (CC)
Process of controlling modifications to hardware, firmware, software and documentation to protect the information system against improper modifications prior to, during and after system implementation.
Configuration Management (CM)
A collection of activities focused on establishing and maintaining the integrity of information technology products and information systems, through control of processes for initializing, changing and monitoring the configurations of those products and systems throughout the system development lifecycle.
Continuous Integration and Continuous Delivery (CI/CD)
Workflow automation processes and tools that attempt to reduce, if not eliminate, the need for manual communication and coordination between the steps of a software development process.
Covert Channel or Covert Path
A communications pathway between two or more processes that transfers information in ways that violate some security policy or requirement. These can be created deliberately (wittingly) by the process designer(s), or unwittingly by the hostile process exploiting hitherto unrecognized exposures of information, resources or other characteristics by the target system.
Data Contamination
Attackers can attempt to use malformed inputs—at the field, record, transaction or file level—in an attempt to disrupt the proper functioning of the system.
