Domain 8 - Software Development Security Flashcards
1
Q
Code repositories
A
- where source code and related artifacts (such as libraries) are stored. Do not commit sensitive information, protect access to code repo, sign your work, keep dev tools (IDE) up to date, most repos use git (most widely used modern version control system)
2
Q
Code libraries
A
- improve security and reduce risk, ie certain languages are prone to certain attacks > in lower level languages like C, use of safe memory allocation and string manipulation libraries can reduce risk of buffer overflow attacks. Utility functions that other people have written ie encryption, bulk data transfer, etc.
3
Q
Runtime
A
- describes the period of time during which a software program is running, where dynamic application testing (DAST) evaluates the security of an application, assessing software sec at runtime is generally the only option because you don’t have option to the source code, for containers scan at build time and runtime, both source code and runtime scan for apps is best practice when source code is available
4
Q
CI/CD
A
- continuous integration continous delivery, how we deliver frequent releases, implement identity and access management (including MFA) to restrict access to pipeline, store secrets securely and scan code to ensure no hard-coded secrets, implement role-based access control (and least privilege access) to the environment, automate vulnerability scanning in ci/cd pipeline, release versioning for tracking and recoverability
5
Q
Static Application Sec Testing
A
- analysis of software performed without actually executing the program, tester has access to the underlying framework/design/implementation, requires source code, tests “inside out”
6
Q
Dynamic application sec testing (DAST)
A
executes the application, tester has no knowledge of underlying tech or source code, “outside in”
7
Q
SCM (software configuration management)
A
baselining aka snapshot of a system/ app, should also create artifacts that may be used to help understand system config
8
Q
Tables (RDBMS)
A
- aka relations, contain a number of attributes/ fields. Each one corresponds to a column in the table
9
Q
Rows (RDBMS)
A
- aka records or tuples, data record within a table, each row reps a complete record of specific item data
10
Q
Columns (RDBMS)
A
- set of data values of a particular type, one value for each row of the database ie “first name” “job title” etc, aka fields or attributes, DEGREES of the table are # of columns
11
Q
Candidate Keys (RDBMS)
A
subset of attributes that can be used to uniquely identify any record in a table, no 2 records in the same table will ever contain the same values for all attributes composing a candidate key, ie “student ID” or “Patient number”, can be one or more per table
12
Q
Primary key (RDBMS)
A
- selected from set of candidate keys for a table to be used to uniquely identify the records in a table, only one per table, chosen at design time, ie “patient number” or “employee ID”
13
Q
Foreign Keys (RDBMS)
A
- enforce relationships between 2 tables, aka referential integrity. Ensures that if one table contains a foreign key, it corresponds to a still existing primary key in the other table in the relationship
14
Q
Aggregation attack (RDBMS)
A
- create sensitive information by combining non-sensitive data from separate sources, need to know and least privilege can prevent, based on math usually
15
Q
Inference attack (RDBMS)
A
- deduce sensitive information from observing non-sensitive pieces of information, blurring data and database partitioning may prevent this attack, based on human deduction
16
Q
Primary memory (real memory)
A
- directly available to CPU aka RAM aka volatile RAM!! Most high performance storage available, ops happening in memory are fast than writing to storage,
17
Q
Secondary storage
A
- inexpensive non-volatile storage available for long term use, includes magnetic and optical media ie tapes, disks, hard drives, flash drives, CD/DVD storage
18
Q
Virtual memory
A
- allows a system to simulate primary memory resources through the use of secondary storage ie system low on RAM makes a hard disk available for direct CPU addressing
19
Q
Virtual storage
A
- simulate secondary storage through the use of primary storage, most common example is RAM disk that presents itself to the OS as secondary storage, provides a very fast file system for apps but no recovery capability
20
Q
Random access storage
A
- allows OS to request contents from any point within the media, RAM and Hard Drives
21
Q
Sequential access storage
A
- requires scanning through entire media from beginning to reach a specific address, ie magnetic tape, old school magnetic storage backup tapes
22
Q
Volatile storage
A
- loses contents when power is removed, ie RAM
23
Q
Non-volatile storage
A
- does not depend on presence of power to maintain contents, magnetic/ optical media and nonvolatile RAM (NVRAM)
24
Q
Expert systems
A
- consist of 2 systems > knowledge base that contains series of “if/ then” rules > inference engine that uses that information to draw conclusions about other data
25
Q
Machine learning
A
- attempt to algorithmically discover knowledge from datasets
26
Q
Neural networks
A
- simulate function of the human mind, arrange layered calculations to solve problems, require extensive training on a particular problem before they can offer solutions
27
Q
Agile
A
- emphasis on the needs of the customer and quickly developing new functionality that meets those needs in an iterative fashion, RESPONSIVE TO CUSTOMER NEEDS, more responsive than waterfall (opposing strategies), 4 principles!! Individuals/ interactions over processes and tools, working software over comprehensive documentation, customer collaboration over contract negotiation, responding to change over following a plan. Gets to finish line faster since we can pivot quickly
28
Q
Waterfall
A
- describes a SEQUENTIAL development process that results in the development of a finished product, less responsive than agile (opposing strategies), 7 stage process that allows return to previous stage for corrections. 7 steps: system requirements > software requirements > preliminary design > detailed design > code and debug > testing > ops and maintenance. Each phase can only go back 1 phase for correction
29
Q
Spiral
A
- uses several iterations of waterfall to produce a number of fully specified and tested prototypes. Each loop ends in a new prototype, ITERATIVE
30
Q
Software development maturity models
A
- improve maturity and quality of software processes by implementing evolutionary path from ad hoc, chaotic processes, to mature disciplined software processes. Know SE-CM and IDEAL
31
Q
Capability maturity model (SW-CMM)
A
- 5 step model for measuring software development: level 1 initial = no plan > level 2 repeatable = basic lifecycle management > level 3 defined = formal and documented SW dev process > level 4 managed = quantitative measures to gain detailed understanding > level 5 optimized = continuous dev process with feedback loops (CI/CD)
32
Q
IDEAL Model
A
- model for software development, similar to SW-CMM. STEPS: Initiating = business reasons outlined, support & infra put in place > diagnosing = engineers analyze current state of org & make recs for change > Establishing = org takes recs & develops plan to achieve the changes > Acting = putting the plan into action > Learning = org continuously analyzes efforts/ results and proposes new actions to drive better results
33
Q
Request Control
A
- organized framework within which users can request mods, managers can conduct cost/ benefit analysis, and devs can prioritize tasks
34
Q
Change control
A
- used by devs to recreate the situation encountered by the user and analyze appropriate changes to remedy the situation
35
Q
Release control
A
- once code changes are finalized, they must be approved for release through release control procedure. Should also include acceptance testing to ensure the alterations are understood and functional
36
Q
Software Testing
A
- should be tested thoroughly before distributing, programming team should develop special data sets that exercise all paths of the software to the fullest extent possible, can be automated or manual
37
Q
File infection
A
- infect different types of executable files and trigger when the OS attempts to execute them ie .exe files
38
Q
Service injection
A
- escape detection by injecting into trusted runtime processes of the OS such as svchost.exe, winlogon.exe, and explorer.exe
39
Q
Boot sector infection
A
- infects legit boot sector and is loaded into memory during the OS load process
40
Q
Macro infection
A
- infect and spread through code in macros ie visual basic for apps in MS Office docs
41
Q
A/V software
A
- signature and behavioral based, for signature based it must be updated frequently, behavior based flags/ blocks unusual activity even it doesn’t match known malware signature
42
Q
Password crackers
A
- take cred stolen in a breach and extract passwords from it ie hashes
43
Q
Dictionary attacks
A
- uses large dictionary file and runs encryption against all words to obtain their encrypted equivalents, type of brute force
44
Q
Social engineering
A
- tricking user into giving up their password, security awareness training
45
Q
Rootkit (escalation of privilege)
A
- freely available, used as 2nd by attackers to exploit known vulns in various OS enabling attackers to elevate privs
46
Q
Buffer overflow
A
- developer does not validate user input to ensure that it is of an appropriate size, too large of input can “overflow” the memory buffer, common in web forms
47
Q
Backdoor
A
- undocumented command sequence that can allow individuals to bypass normal access restrictions, often used during development and debugging
48
Q
Time of check to time of use (TOC/TOU)
A
- timing vuln that occurs when a program checks access permissions too far in advance of a resource request
49
Q
Cross site scripting (XSS)
A
- type of injection where malicious scripts are injected into otherwise benign and trusted websites, attacker uses a web app to send malicious code to a different end user, occur when web apps contain “REFLECTED INPUT”
50
Q
SQL Injection attacks
A
- use unexpected input to a web application to gain unauthorized access to an underlying database
51
Q
Cross Site Request Forgery (CSRF)
A
attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing
52
Q
IP Probes
A
- ping each ip address in a range, systems that respond are logged for further analysis
53
Q
Port scan
A
- look for open and listening ports
54
Q
Vuln scan
A
- look for specific vulns
55
Q
Protection rings
A
- aka hierarchical protection domains, RINGS: Ring 0 = kernal > ring 1 = device drivers > ring 2 = device drivers > ring 3 = applications
56
Q
Software Development Lifecycle (SDLC)
A
Real Developers Ideas Take Effort
○ Requirements analysis (SDLC) -
○ Design (SDLC) -
○ Implementation (SDLC) -
○ Testing (SDLC) -
Evolution (SDLC) -
57
Q
Concentric circle security
A
- several mutually independent sec applications, processes, or services that operate toward a single common goal, avoids monolithic security stance, EVERY individual sec mechanism has a flaw or workaround, layered defense, COMBINE countermeasures, DEFENSE IN DEPTH
58
Q
OS attacks
A
- buffer overflow, OS bugs, unpatched OS
59
Q
Application level attacks
A
- overflow, active content, XSS, DoS, SQL injection, session hijacking, phishing
60
Q
Shrink wrap code attacks
A
- exploiting holes in unpatched or poorly configured software you buy and install
61
Q
Misconfiguration attacks
A
- target poorly or default configured service or device ie wifi router left in default settings
