Domain 8 - Software Development Security Flashcards
out of IAAS (infrastructure as a service) PAAS (platform as a service) and SAAS (software as a service) which one requires the least amount of responsibility from the business owner and more responsibility from the cloud vendor
SAAS (software as a service) puts all the responsibility for security and maintenance on the cloud vendor. The business only provides their data
in cloud computing, what is a private cloud?
organizations build and run their own cloud infrastructure
in cloud computing what is a public cloud?
shared tenancy (Amazon AWS, Microsoft, Google, IBM) a company builds a massive infrastructure and rents or leases the products or services
in cloud computing, what is a hybrid cloud?
a mix of private and public
in cloud computing, what is Community cloud?
someone that has shared interest, maybe all the chief technical officers in banks in California. They may have a community cloud to discuss important topics, current issues and solutions they share.
out of IAAS (infrastructure as a service) PAAS (platform as a service) and SAAS (software as a service) which one requires the most amount of responsibility from the business owner and least responsibility required from the cloud vendor
IAAS (infrastructure as a service) requires the business/customer to own the most amount of responsibility. The customer is responsible for, OS, databases, security and applications.
what is the customer responsible with PAAS (platform as a service)
the customer is responsible for the application and that’s all. The cloud vendor is responsible for everything else
what do we want for programing – high or low cohesion
High
what do we want for programming – high or low coupling
low
~~~
in programming, cohesion and coupling what is the goal
1. high cohesion, high coupling
2. high cohesion, low coupling
3. low cohesion, low coupling
4. low cohesion, high coupling
- high cohesion, low coupling
maximize cohesion and minimize module dependencies (coupling)
change and configuration management steps (CCM)
- request control
- change control
- release control
change and configuration management - what happens in request control
- change is requested
- managers can conduct cost/benefit analysis
- developers can prioritize tasks
SDLC is part of a larger process known was SLC - what are the two additional phases after implementing SDLC
- Operations and maintenance support(post installation) - monitor for weakness, bacup, restore, methods are implemented. periodic risk analysis
- ** Revisions and system replacment** - changes to SLC follow change management
what is the primary way to prevent cross site scripting vulnerability
- input validation
- 2 types of this attack
— stored (persistant)
— reflected (most common) - all flavors targe the victims browser*
what is the major way to prevent SQL injection
- input validation
- programs should never allow SQL code to be passed directly from a user to the database
what is IDE in software developing
Integrated Development environment
cross site request forger attack
- target a web application
- accomplished by tricking a valid and authenticated user into sending some commands to web applications that trusts the user
- the web application executes these command from an attacker that it should not be executing
concentric circle security is what
- defense in depth or
- layered security
What are some Application-Level Attacks
- overflow, active content, cross-site script, denial of service, SQL injection, session hijacking , phishing.
polyinstantiation
- allows different versions of the same information to exist at different classification levels
- can be used to prevent unauthorized inference by creating different objects of the same name simultaneously
Operating system Attacks
- attackers always try to search for operating system vulnerabilities, like buffer overflow , OS bugs, unpatched operating system.
Misconfiguration Attacks
- target poorly configured service or device, or one left in default configuration (like WiFi router left in default settings)
buffer overflow ways to prevent
- code should be written to perform parameter or bounds checking
—never allow a chunk of data written to the buffer that is larger than the buffer -
Adress space layout randomization (ASLR)
—guards against buffer overflow by randomizing the location where system executibles are loaded into memory
Shrink Wrap Code Attacks
- an act of exploiting holes in unpatched or poorly configured software you buy and install. Often also often contain sample scripts/code.
2 major types of APIs
- REST - representational state transfer
* (most common used)
* lightweight and fast - SOAP - simle object access protocol
* complex and heavyweight
* more capabilities
code obfuscation
- creating code that is difficult for humans to understand
- makes code difficult to reverse engineer
- conceal the purpose of the code
- prevent unauthorized person to know what the code is and does
3 types of code obfuscation
- Lexical - modifies the look (changing comments, removing debugging info and changing format of the code (easiest to do but weakest form)
- data - modifies the data structure (use of variables)
- Control flow - modifies flow of control through the code, reodering statements, methods, loops, creating irrelevant conditional statements
how do you protect against buffer overlfow
- parameter or bounds checking
- do not allow a chunk of data to be written to a buffer that is larger than the buffer
what is xml
- XML stands for eXtensible Markup Language
- XML is a markup language much like HTML
- XML was designed to store and transport data
- XML was designed to be self-descriptive
- XML is a W3C Recommendation
change control steps
- request control
- change control
3.release control
explain due diligence
- its the things the we are doing in advance
- when we are building out and maintaining our security program, we are doing due diligence to be prepared when something goes wrong
*
explain due care
- more tactical and in the moment
- taking the same care the a reasonable person would take under the same circumstances
- day to day security decisions are the same decision that a resonable person would make
- how we configure our firewall rules to how we carry out our incidence response plans
due care vs due diligence
- creating a plan is due diligence
- creating the security framework and governance is due diligence
- creating the policys, procedures , put controls in place, run vulnerability scans, deploy firewalls, countless other controls in place to ensure we are ready when something goes wrong – this is due diligence
- following the plan and doing, is due care
- following the policies, procedues and guildelines
- following up on vulnerability scans and doing something about them
- following up on intrusuion alerts
- analyzing firewall logs
- implementing our incident resposne process
- taking care of any issues found or looking for the issue if you find a hint of something being wrong is due care
- you would not ignore a security concern, you would look for the root cause
Which of the following are rows and columns within relational databases?
A. Rows and tuples
B. Attributes and rows
C. Keys and views
D. Tuples and attributes
D. In a relational database, a row is referred to as a tuple, whereas a column is referred to as an attribute.
Tim is a software developer for a financial institution. He develops middleware software code that carries out his company’s business logic functions. One of the applications he works with is written in the C programming language and seems to be taking up too much memory as it runs over a period of time. Which of the following best describes what Tim should implement to rid this software of this type of problem?
A. Bounds checking
B. Garbage collector
C. Parameter checking
D. Compiling
B. Garbage collection is an automated way for software to carry out part of its memory management tasks. A garbage collector identifies blocks of memory that were once allocated but are no longer in use and deallocates the blocks and marks them as free. It also gathers scattered blocks of free memory and combines them into larger blocks. It helps provide a more stable environment and does not waste precious memory. Some programming languages, such as Java, perform automatic garbage collection; others, such as C, require the developer to perform it manually, thus leaving opportunity for error.
stride threat modeling mitigations per level
Stride mitigation below
use/misuse cases
threat modeling approach
use/misuse
Agile software development
Agile development
Software development life cycle picture
dont forget the planning – phase 1
what levels of cohesions and coupling are we aiming for
high cohesion
low coupling
cohesion and coupling attributes
attributes below
SDLC
NIST 800-64 no longer exist but this is what we are going to try to learn
from NIST 800-64 and BE INFOSEC youtube
SDLC from shon harris and technical institue of america youtube
2nd version…remember one of them
TCB (trusted computing base)
- totality of protection mechanisms withing a system
* *** breaking it down and examples
* all (everything) protection mechanisms - hardware: TPM
- Firmware - low level software (code signing)
- software: antimalware, host based firewall, security kernel
how digital signatures bind owners to their private keys:
good explaination Here
- alice reaches out to digitalcert for a certificate
- Alice gives digicert a little bit of information on herself including her name and a copy of her public key
- The next step is to proof her identity. The RA (registration authority) verifies that Alice is who she says she is. This is called identity proofing
- The CA (certificate authority) takes Alice’s ID, Alice’s public key and other information such as period of validity then hashes it
- the CA will then use its private key to sign that hash
- The digital certficiate contains
* name of the owner
* copy of their public key
* period of validity
* signed with the CA public key
I hope i have this correct now
