Domain 8: Software Development Security Flashcards
1
Q
Acceptance
A
A formal, structured handover of the finished software system to the customer organization; typically involves test, analysis, and assessment activities.
2
Q
Accreditation (also Security Accreditation)
A
Formal declaration by a designated accrediting authority (DAA) that an information system is approved to operate at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural safeguards.
3
Q
ACID Test
A
Data integrity provided by means of enforcing atomicity, consistency, isolation, and durability policies.
A.c.i.d tests integrity
4
Q
Advanced Persistent Threats (APTs)
A
An agent or organization of agents that plans, organizes, and carries out a highly sophisticated attack against a target person, organization, or industry over a period of months or possibly even years (thus “persistent”). APTs usually have a strategic goal in mind, which requires many steps in a concerted attack plan to achieve. The term “APT” may refer to the organization conducting the attack, to specific steps in such an attack as observed by a target, or to the entire attack sequence. An APT usually involves a phased set of activities, each of which may use dozens of different attack vectors in sequence or in tandem.
5
Q
Aggregation
A
The ability to combine nonsensitive data from separate sources to create sensitive information.
6
Q
Blocked and Allowed Lists (software, identities, addresses)
A
Use of lists of blocked or allowed identities—whether as users, URLs, URIs, web addresses, IP addresses, geographic regions, hardware addresses, files, or program—as a means of controlling (prohibiting or permitting) their access, use, or attempt to load and execute. These systems also alert designated IT security personnel if the attempt involves a resource not on a pre-approved list. Stand-alone security tools and integrated systems that provide these capabilities are now starting to incorporate anti-malware processesas part of their offerings; similarly, anti-malware products have begun to incorporate these blocked/allowed list management and use capabilities. In this course, the term “blocked list” replaces “blacklist” and the term “allowed list” replaces “whitelist.”
7
Q
Botnets
A
A network of automated systems or processes (robots, or for short, bots) performing a specific function together, usually malicious. Botnets have greatly magnified the power and speed of malicious operations because they all work together toward achieving a malicious goal, and they have allowed for tuning and directing of operations in a way that was not possible with malicious programs in the past.
8
Q
Bots
A
An emerging and special class of mobile code. These employ limited machine learning capabilities to assist with user requests for help or assistance, automation of or assistance with workflows, data input quality validation, and other similar tasks.
9
Q
Buffer Overflow
A
A source code vulnerability that allows attempts to access data locations outside of the storage space to be allocated to the buffer. It can be triggered by attempting to input data that is larger than the input buffer being used.
User input is not validated and not appropriate size, it overflows the data structure allowing malicious commands.
10
Q
Bypass Attack
A
Users may attempt to bypass controls at the front end of the database application to access information.
11
Q
Certification
A
The comprehensive technical security analysis of the system to ensure that it meets all applicable security requirements.
12
Q
Citizen Programmers
A
Members of the organization who codify work-related knowledge, insights, and ideas into varying degrees of reusable software-like forms, often using extensibility features found in most commercial software apps. The ad hoc nature of these pieces of functionality is extremely difficult to manage, control, verify, or assess. In almost all cases, these are beyond the reach and visibility of the organization’s software quality, configuration management, or security assessment processes. Such “citizenprogramming” is often done with little regard to security requirements and can pose a significant risk to some organizations.
13
Q
Code Protection or Logic Hiding
A
Prevents one software unit from reading or altering the source, intermediate, or executable code of another software unit.
14
Q
Code Reuse
A
When programmers reuse, rather than reinvent, units of software (procedures or objects) that have already been demonstrated to be correct, complete, safe, and secure.
15
Q
Commercial Off-the-Shelf (COTS)
A
Software elements, usually applications, that are provided as finished products not intended for alteration by the end user. Most COTS applications are available as host- based, endpoint-based, or platform-based services, and support user extensibility by means of non-programming tools, scripts, macros, and configuration parameters. COTS can also include firmware and hardware elements.
16
Q
Common Object Request Broker Architecture (CORBA)
A
A set of standards that addresses the need for interoperability between hardware and software products residing on different machines across a network. CORBA provides object location and use across a network.
An international standard for
distributed computing. CORBA enables code operating on a computer to locate resources
located elsewhere on the network.
17
Q
Configuration Control (CC)
A
Process of controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modifications prior to, during, and after system implementation.
18
Q
Configuration Management (CM)
A
A collection of activities focused on establishing and maintaining the integrity of information technology products and information systems, through control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the system development life cycle.
19
Q
Continuous Integration and Continuous Delivery (CI/CD)
A
Workflow automation processes and tools that attempt to reduce, if not eliminate, the need for manual communication and coordination between thesteps of a software development process.
20
Q
Covert Channel or Covert Path
A
A communications pathway between two or more processes that transfers information in ways that violate some security policy or requirement. These can be created deliberately (wittingly) by the process designer(s), or unwittingly by the hostile process exploiting hitherto unrecognized exposures of information, resources, or other characteristics by the target system.
21
Q
Data Contamination
A
Attackers can attempt to use malformed inputs—at the field, record, transaction, or file level—to disrupt the proper functioning of the system.
22
Q
Data Lake
A
A data warehouse incorporating multiple types or streams of unstructured or semi-structured data.
23
Q
Data Mining
A
An analysis and decision-making technique that relies on extracting deeper meanings from many different instances and types of data; often applied to data warehouse content.
Gather mining resources to make decision
24
Q
Data Modeling
A
A design process that identifies all data elements the system will need to input, create, store, modify, output, and destroy during its operational use. Arguably, data modeling should be one of the first steps in systems analysis and design, regardless of whether procedural or OOP approaches will be used to implement it.
25
Data Protection or Data Hiding
Restricts or prevents one software unit from reading or altering the private data of another software unit.
26
Data Type Enforcement
How well (or how poorly) a language protects the programmer from trying to perform operations on dissimilar types of data, or in ways that would lead to erroneous results.
27
Data Warehouse
A collection of data sources such as separate internal databases to provide a broader base of information for analysis, trending, and reference. May also involve databases from outside of the organization, either by importing a copy or by reference.
28
Database Management System (DBMS)
A suite of application programs that typically manage databases and their environments. The heart of the DBMS is the database engine, a core application that performs and manages the basic functions of create, read, update, and delete (CRUD) of data to and from the database, while also making data available for display or export to users, endpoints, and other systems. The DBMS provides the structure for the data and some type of language and architecture for accessing and manipulating the data. The main objective is to store data and allow users to interact with it, but in a secure way from a confidentiality, integrity, and availability perspective.
29
Database Model
The underlying software design concepts that a DBMS implements; it identifies the specific organization, structure, and architecture that the DBMS can provide to users as they build specific databases to meet business needs.
30
Data-Centric Threat Modeling
A methodology and framework for focusing on the authorized movement, locations, execution, input, and output of data within, from, and into a system. These correspond with the security concepts of protecting data in transit, at rest (or in storage), and in use, and it provides a focus for carrying out the security decisions already made as the organization classifies and categorizes its data.
31
Defensive Programming
The style of program design and coding that translates the business logic about acceptable and harmful input into code, which allows processing of acceptable inputs, but safely blocks attempts to input (or inject) harmful inputs. The lack of adequate defensive programming measures can result in an arbitrary code execution, a misdirection of the program to other resources or locations, or otherwise reveal more information useful to an attacker.
32
DevOps
A systems development approach based on lean and agile principles in which business owners and the development, operations, and quality assurance departments collaborate to deliver software in a continuous manner that enables the business to more quickly react to market opportunities and reduce the time to include customer feedback into products that need to be developed.
33
DevSecOps
Provides for a merger of phased review (as in the waterfall SDLC) with the DevOps method, to incorporate the needs for security, safety, resilience, or other emerging properties in the final system, at each turn of the cycle of development.
34
Dynamic Application Security Testing (DAST)
Tools that execute the software unit, application, or system under test in ways that attempt to drive it to reveal a potentially exploitable vulnerability.
35
Emerging Properties
An alternate and perhaps more powerful way of looking at systems-level behavior characteristics such as safety and security. This perspective also helps provide a more testable, measurable answer to questions such as “How secure is our system?”
36
Encapsulation
Enforcement of data hiding and code hiding during all phases of software development and operational use. Bundling together data and methods is the process of encapsulation; its opposite process may be called unpacking or revealing. Also used to refer to taking any set of data and packaging it or hiding it in another data structure, as is common in network protocols and encryption.
37
Executable Code, Object Code
The binary representation of the machine language instruction set that the CPU and other hardware of the target computer directly execute.
38
Extensible Markup Language (XML)
A set of extensions to HTML that provide for data storage and transport in networked environments. XML is frequently used to interface web pages at the front end of a system (as they are displayed and used on client endpoint devices) with databases on back-end servers. XML is often embedded in the HTML files that make up the elements of web pages.
39
Functional Requirements
Describes a finite task or process the system must perform. These are often directly traceable to specific elements in the final system’s design and construction; formal configuration item audits should, for example, be able to identify a given unit of software with the specific functional requirements that dictated it be written and included into the product build.
40
Hierarchical Database Model
Database model in which data elements and records are arranged in parent-child structures such as trees.
41
Independent Verification and Validation (IV&V)
A comprehensive review, analysis, and test (software or hardware, or both) performed by an objective third party to confirm (i.e., verify) that the requirements are correctly defined, and to confirm (i.e., validate) that the system correctly implements the required functionality and security requirements.
42
Inheritance
Provides mechanisms by which objects that are members of a class (a higher- level grouping of like objects) can make use of specific characteristics of the class. Files in a read-only folder, for example, generally will also inherit the folder’s read-only attribute.
43
Interactive Application Security Testing (IAST)
Testing that combines or integrates SAST and DAST to improve testing and provide behavioral analysis capabilities to pinpoint the source of vulnerabilities.
44
Integrated Development Environments (IDEs)
A set of software applications, their control procedures, supporting databases, libraries, and tool sets that provide a programmer or a team of programmers what they need to specify designs; translate designs into source code; and then compile, test, and integrate that code into a finished software product. Many IDEs support multiple programming languages and facilitate their use on the same project.
45
Integrated Product Team (IPT)
A team of stakeholders and individuals who have various skills and work together to achieve a defined process or product.
46
Intermediate Code
Expressing a program’s required function in a form that is somewhere between human-readable source code and binary sets of values that can be loaded into memory and executed by a CPU. The most common use of intermediate code is to provide machine independence or portability for a program, such as Java does.
47
Knowledge Discovery in Database (KDD)
A mathematical, statistical, and visualization method of identifying valid and useful patterns in data.
48
Knowledge Management
The efficient and effective management of information and associated resources in an enterprise to drive business intelligence and decision-making. It may include workflow management, business process modeling, document management, databases and information systems, and knowledge-based systems.
49
Level of Abstraction
How close the description (in source code, design documents, or any other form) represents one-to-one the details of the underlying object, system, or component. Lower- level abstractions generally have far more fine- grain detail than higher level ones.
50
Living Off the Land Nonmalware-Based Ransom Attack
An attack on a system in which illicit access to a system is used to misuse systems capabilities in the pursuit of the attacker’s agenda. The attacker does not use malware in such attacks, hence, anti-malware defenses will not detect and prevent it.
51
Logic Bombs
Malware inserted into a program that will activate and perform functions that suit an attacker’s needs at some later date or when certain conditions are met.
52
Malformed Input Attack
Many of the common source code errors in software can lead to that software failing to correctly handle input data, singly or in combination, that exceeds logical range checks, is contradictory or inconsistent, or is unauthorized. This can result in an arbitrary code execution, a misdirection of the program to other resources or locations, or otherwise reveal additional information useful to an attacker.
53
Malware
A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system or of otherwise annoying or disrupting the victim.
54
Markup Languages
Nonprogramming languages used to express formatting or arrangement of data on a page or screen. Markup languages are extensible, which allows users to define other operations to be performed. These extend the language into a programming language, such as the way that JavaScript extends HTML.
55
Memory or Object Reuse
All systems must allocate memory or other resources as objects to requesting processes, which involves one process reusing such resources after the first using process has finished with them. Any data remaining in the object when it is reused is a potential security violation (i.e., a data remanence issue).
56
Metadata
Information that describes the format or meaning of other data, which can be used to provide a systematic method for describing resources and improving the retrieval of information.
57
Mobile Code (Executable Content)
A file or a set of files sent by one system to one or more other target or client systems, which, when opened by software already installed on that client, will either control the execution of systems and applications software on that client or be directly executed by that client’s CPU.
58
Modified Prototype Model (MPM)
An approach to designing and building a system that starts by building a simplified version of the entire application; this is released for review, with the feedback from the stakeholders used to improve the design of a second, much better version. This is repeated until the owner and stakeholders are satisfied with the final product.
59
Network Database Model
Database model in which data elements and records are arranged in arbitrary linked fashion, such as lists, clusters, or other network forms.
60
Nonfunctional Requirements
Identifies broad characteristics of the system as a whole. These usually do not align with a clearly identified subset of systems elements. Typically, many safety, security, privacy, and resiliency needs have been deemed nonfunctional by their systems’ analysts and engineers, and, as such, configuration audits cannot identify whether any given software unit contributes to such nonfunctional requirements, or indeed if any of them do.
61
Object
An encapsulation of a set of data and the methods that can be used to manipulate that data.
62
Object-Oriented (OO) Database Model
A database model that uses object-oriented programming concepts of classes, instances, and objects to organize, structure, and store both data and methods. Schemas define the structure of the data (in terms of tables, records, and attributes or fields); views establish specific selections of tables, rows, and columns to meet user or security needs.
63
Object-Oriented Programming (OOP)
Defines an object to be a set of software that offers one or more methods, internal to the object, that software external to that object can request be performed. Each method may require specific inputs and resources and may produce a specified set of outputs.
64
Open-Source Software
Software whose source code and other design information is made publicly available for inspection, testing, assessment, and use. In many cases, open-source licenses allow modification and refactoring. While many commercial software products protect their source code as proprietary, others include or are licensed, supported reuse of open-source software.
65
Polyinstantiation
Creates a new instance (or version copy) of a data item, with the same identifier or key, allowing for each process to have its own version of that data. Useful for enforcing and protecting different security levels for a shared resource.
66
Polymorphism
Allowing an object to “take many forms” based on how it is used means that changes to an object do not have to ripple out into every application’s program that uses that object.
67
Procedural Programming
Emphasizes the logical sequence or flow of steps to be performed. A “procedure” is a set of software that performs a particular function, requires specific input data (and possibly other resources), and produces a specific set of outputs. Outputs may include error signals, when appropriate. Procedures can invoke (“call”) other procedures.
68
Query Attack
Use of query tools to access data not normally allowed by the trusted front end, including the views controlled by the query application. Malformed queries using SQL to bypass security controls may be possible as well. There are many other examples of where improper or incomplete checks on queries
69
Ransom Attack
Any form of attack that threatens the destruction, denial, or unauthorized public release or remarketing of private information assets. It usually involves encrypting these assets and withholding the decryption key until the ransom is paid by the victim.
70
Ransomware
Malware used for the purpose of facilitating a ransom attack.
71
Rapid Application Development (RAD)
A development methodology that creates an application more quickly by employing techniques such as the use of fewer formal methodologies and reuse of software components.
72
Refactoring
A partial or complete rewrite of a set of software to perform the same functions, but in a more straightforward, more efficient, or more maintainable form.
73
Regression Testing
Testing of a system to ascertain whether recently approved modifications have changed its performance of other approved functions or has introduced other unauthorized behaviors.
74
Relational Database Model
Database model in which data elements and records arranged in tables, and tables are related (linked) to each other to implement a business logic needed to use data records of different structures or types together in the same activity.
75
Representational State Transfer (REST)
A software architectural style for synchronizing the activities of two (or more) applications running on different systems on a network. REST facilitates these processes exchanging state information, usually via HTTP or HTTPS.
76
Runtime Application Security Protection (RASP)
Security agents (small code units) built into an application by the developer that can detect a given set of security violations; upon such detection, the RASP agents can cause the application to terminate, or take other protective actions.
77
Sandbox
A testing environment that is logically, physically, or virtually isolated from other environments, and in which applications or systems can be evaluated. Sandboxes can be used as part of development, integration, or acceptance testing to not interact with the production environments, as part of malware screening, or as part of a honeynet.
78
Scanners (Anti-malware)
Software that examines a suspected file or set of files for the presence of malware, by signature analysis, activity monitors, heuristics, and machine learning techniques or change analysis.
79
Secure Coding Guidelines and Standards
Best practices identified by a variety of software and security professionals that, when used correctly, can dramatically reduce the number of exploitable vulnerabilities introduced during development that remain in the operationally deployed system.
80
Security Assessment
Testing, inspection, and analysis to determine the degree to which a system meets or exceeds the required security posture. This may assess whether an as-built system meets the requirements in its specifications, or whether an in-use system meets the current perception of the real-world security threats the system may be facing.
81
Software (Quality) Assurance
A variety of formal and informal processes that attempt to determine whether a software application or system meets all. its intended functions, does not perform unwanted functions, is free from known security vulnerabilities, and is free from insertion of other errors in its design, code, form, function, and data.
82
Software Capability Maturity Modeling (SW-CMM) and Assessment
A management process to foster the ongoing and continuous improvement of an organization’s processes and workflows for developing, maintaining, and using software.
83
Software Development Life Cycle (SDLC)
A framework and a systematic process with associated tasks that are performed in a series of steps for building, deploying, and supporting software applications. The life cycle begins with planning and requirements gathering and ends with decommissioning and sunsetting the software. There are many different SDLCs—such as agile, DevSecOps, and rapid prototyping— offering different approaches to defining and managing the software life cycle.
84
Software Libraries
A repository of prewritten code, classes, procedures, scripts, and other programming elements. These may be provided by systems or applications vendors, from trustworthy third-party developers, developed in-house by the organization’s programmers, or available from various open-source sites.
85
Source Code
Program statements written in human-readable form using a formal programming language’s rules for syntax and semantics.
86
Spiral Method
Improved waterfall development process, which provides for a cycle of Plan, Do, Check, and Act (PDCA) substages at each phase of the SDLC.
87
Spyware and Adware
Software that performs a variety of monitoring and data gathering functions. Also known as potentially unwanted programs or applications (PUPs or PUAs), these may be used in monitoring employee activities or their use of systems resources (spyware); adware facilitates advertising efforts. Both may be legitimate and authorized by systems owners to be in use or may be unwanted intruders in these systems.
88
Static Application Security Testing (SAST)
Also known as static source code analysis, these are tools that examine the source code for a variety of errors such as data type errors, loop and structure bounds violations, and unreachable code. Since SAST tools do not attempt to execute or simulate the execution of the code being analyzed, it is a bit of a misnomer to call them “testing” tools.
89
Strong Data Typing
A feature of a programming language that prevents data type mismatch errors (such as trying to add amounts of money to dates or times). Strongly typed languages will generate errors at compile time, forcing the programmer to correct a type mismatch or include additional code that performs the correct data type conversion at runtime.
90
Threat Surface
The total set of penetrations of a boundary or perimeter that surrounds or contains systems elements.
91
Time of Check versus Time of Use (TOCTOU) Attacks
Takes advantage of the time delay between a security check (such as authentication or authorization) being performed and actual use of the asset.
92
Trapdoor or Backdoor
A hidden mechanism that bypasses access control measures. It is an entry point into an architecture or system that is inserted in software by developers, during the program’s development, to provide a method of gaining access into the program for modification and support reasons. It can also be inserted by an attacker, bypassing access control measures designed to prevent unauthorized software changes.
93
Trojans
Malware that inserts backdoors or trapdoors into other programs or systems. The malware may or may not be disguised as some useful or entertaining application.
94
Trusted Computing Base (TCB)
The collection of all the hardware, software, and firmware components within an architecture that is specifically responsible for security and the isolation of objects. TCB is a term usually associated with security kernels and reference monitor.
95
View-Based Access Controls
An access control process that allows the database to be logically divided into pieces (individual records, fields, or groups of items) that allow certain sensitive data to be hidden from users that are not authorized to see it or manipulate it. Administrators can set up a view for each type of user and then each user can only access the view assigned to them. Some database views will allow the restrictions to be granular—for example, of both rows and columns—while others allow for views that can write and update data as well as the capability to only read.
96
Virus
A software program written with the intent and capability to copy and disperse itself without the knowledge and cooperation of the owner or user of the system. Researchers of malicious software disagree on a perfect definition of a virus; however, a common definition may be a program that modifies other programs to contain a possibly altered version of itself.
97
Cycle (SDLC)
Traditional or classic software development life cycle model with clearly defined boundaries between each phase. There are many variations on this model, with phases such as concept or mission; needs identification; requirements definition; systems design; software and data systems coding; unit, subsystem, and systems testing; acceptance testing; and deployment to operational use. There are many other SDLCs as models and business processes, all different, which are not “waterfall” in concept or use.
98
Worm
A software program written with the intent and capability to copy and disperse itself without the knowledge and cooperation of
99
runtime environment
A system that allows the portable execution of code across different
operating systems. This may include sandboxes, virtual machines, and containerization.
100
compiler
A software development tool that converts higher-level language code into a
machine language executable file designed for use on a specific operating system.
101
decompiler
A specialized programming tool that may be able reverse the compilation process. Decompilers attempt to take binary executables and convert them back into source code
form. See disassembler
102
software library, Software libraries
A collection of reusable code for developers. These
libraries perform a variety of functions, ranging from text manipulation to machine learning,
and are a common way for developers to improve their efficiency.
103
input validation
An aspect of defensive programming intended to ward off a wide range
of input-focused attacks, such as buffer overflows and fuzzing. Checking, scanning, filtering,
or sanitizing input received from users (especially over the internet) before processing the
received input. See also input sanitization.
104
limit check
A type of input validation, where the code checks to ensure that a number falls
within an acceptable range.
105
Capability Maturity Model (CMM)
A formal software development management concept
that describes the process that organizations undertake as they move toward incorporating
solid engineering principles into their software development processes. Aka software capability maturity model (SCMM, S-CMM).
106
Software Assurance Maturity Model (SAMM)
An open source project maintained by the
Open Web Application Security Project (OWASP). It seeks to provide a framework for integrating security activities into the software development and maintenance process as well as
offer organizations the ability to assess their maturity
107
reasonableness check
The crafting and use of special test suites of data that exercise
all paths of the software to the fullest extent possible and comparison of the results to the
known correct expected outputs.
108
candidate key
A subset of attributes, columns, or fields that can be used to uniquely identify any record in a table. Aka alternate key.
109
foreign key
A primary key from another table used to cross-link or express relationships
between the contents of two tables.
110
normalization
The database process that removes redundant data and ensures that all
attributes are dependent on the primary key.
111
polyinstantiation
The event that occurs when two or more rows in the same table
appear to have identical primary key elements but contain different data for use at differing
classification levels. Polyinstantiation is often used as a defense against some types of inference attacks.
112
primary key
A specific key from the set of candidate keys that is used as the main differentiator between records. Every record must have a unique value in its primary key field.
113
referential integrity
Used to enforce relationships between two tables. One table in the
relationship contains a foreign key that corresponds to the primary key of the other table in
the relationship.
114
tuple
(1) A record or row in a database. (2) A collection of related data items.
115
cardinality
The number of rows in a relational database.
116
degree
The number of columns in a relational database.
117
database contamination
What happens when data or records of different values,
classifications, security domains, and the like are commingled or mixed together. It can be a
form of integrity and confidentiality violation.
118
multipart virus, multipartite virus
Malware that performs multiple tasks and may infect
a system in numerous ways
119
stealth virus
Malicious code that attempts to avoid detection by masking or hiding its
activities.
120
polymorphic
An attribute of some malware that allows the malware to mutate and appear
differently each time it crops up. It is malware that modifies its own code as it travels from
system to system. The mutations make it harder for malware scanners to detect (and react
to) the unwanted code, since the signature of the malware is somewhat different each time it
infects a new system. Aka polymorphic virus or polymorphic malware.
121
encrypted virus
A virus that uses cryptographic techniques to avoid detection. In their outward appearance, they are quite similar to polymorphic viruses—each infected system has a
virus with a different signature. However, they do not generate these modified signatures by
changing their code; instead, they alter the way they are stored on the disk.
122
Trojan (previously Trojan horse)
Any application that masquerades as something
benign to get past scrutiny and then does something malicious. A malicious code object
that appears to be a benevolent program, such as a game or simple utility that performs the
“cover” functions as advertised but also carries an unknown payload, such as a virus. One
of the major differences between Trojans and viruses is that Trojans tend not to replicate
themselves.
123
worm
A form of malicious code that is self-replicating but is not designed to impose direct
harm on host systems. The primary purpose of a worm is to replicate itself to other systems
and gather information. Worms are usually very prolific and often cause a denial of service
because of their consumption of system resources and network bandwidth in their attempt to
self-replicate.
124
endpoint detection and response (EDR)
A security mechanism that is an evolution of
traditional antimalware products. EDR seeks to detect, record, evaluate, and respond to suspicious activities and events, which may be caused by problematic software or by valid and
invalid users
125
user and entity behavior analysis (UEBA), user and entity behavior analytics
The E in
UEBA extends the UBA concept to include entity activities that take place but that are not
necessarily directly linked or tied to a user’s specific actions, but that can still correlate to a
vulnerability, reconnaissance, intrusion, breach, or exploit occurrence. Information collected
from UBA/UEBA monitoring can be used to improve personnel security policies, procedures,
training, and related security oversight programs
126
time of check (TOC)
The time at which a subject checks on the status of an object.
127
time of check to time of use (TOCTOU, TOC2TOC, TOCTTOU, TOC/TOU)
A timing vulnerability that occurs when a program checks access permissions too far in advance of a
resource request. A type of exploitation in which attackers abuse the predictability and precision of task execution to cause a loophole in security filtering or authentication. See also race
conditions.
128
rootkit
A special type of hacker tool that embeds itself deep within an operating system
(OS). The rootkit positions itself at the heart of an OS where it can manipulate information
seen by the OS and its users.
129
injection attack
Any exploitation that allows an attacker to submit code to a target system
to modify its operations and/or poison and corrupt its dataset. See SQL injection, LDAP
injection, DLL injection, HTML injection, and XML injection. Aka injection vulnerabilities
130
blind SQL injection
A means to conduct a SQL injection attack even when there is no
ability to view the results directly.
131
DLL injection
An advanced software exploitation technique that manipulates a process’s
memory to trick it into loading additional code and thus perform operations the original
author did not intend. A dynamic-link library (DLL) is a collection of code that is designed to
be loaded and used as needed by a process. Aka DLL hijacking or DLL injection attack.
132
insecure direct object reference
If an application does not perform authorization checks, the
user may be permitted to view information that exceeds their authority when directly accessed.
133
directory traversal
An attack that enables an attacker to jump out of the web root
directory structure and into any other part of the filesystem hosted by the web server’s host
operating system.
134
file inclusion attack
A web-focused attack that builds on directory traversal. Instead of
simply retrieving a file from the local operating system and displaying it to the attacker, file
inclusion attacks actually execute the code contained within a file, allowing the attacker to
fool the web server into executing targeted code. Variants include local file inclusion and
remote file inclusion.
135
cross-site request forgery (XSRF, CSRF)
An attack that is similar in nature to cross-site
scripting (XSS). However, with XSRF, the attack is focused on the visiting user’s web browser
more than the website being visited. The main purpose of XSRF is to trick the user or the
user’s browser into performing actions they did not intend or would not have authorized
against a targeted server, system, or site. Aka client-side request forgery (CSRF).
136
request forgery
Attacks that exploit trust relationships and attempt to have users unwittingly execute commands against a remote server. They come in two forms: cross-site request
forgery and server-side request forgery.
137
server-side request forgery (SSRF)
A clever exploit where a vulnerable server is coerced
into functioning as a proxy.
138
input whitelisting
The most effective form of input validation in which the developer describes
the exact type of input that is expected from the user and then verifies that the input matches that
specification before passing the input to other processes or servers. Aka input allow listing.
139
input blacklisting
A means to control user input. With this approach, developers do not
try to explicitly describe acceptable input but instead describe potentially malicious input
that must be blocked. Aka input block listing.
140
data minimization
The reduction of data collected or stored to the minimum necessary to
perform essential business tasks.
141
resource exhaustion
When applications are allowed to operate in an unrestricted and
unmonitored manner so that all available system resources are consumed in the attempt to
serve the requests of valid users or in response to a denial-of-service (DoS) attack.
142
memory leak
What occurs when a program fails to release memory or continues to consume more memory. It’s called a leak because the overall computer system ends up with less
available free memory when an application is causing a memory leak.
143
memory pointer
A commonly used concept in application development. Memory
pointers are simply an area of memory that stores an address of another location in memory.
See pointer
144
pointer dereference
The programmatic activity of retrieving the value stored in a memory
location by triggering the pulling of the memory based on its address or location as stored in
a pointer (a type of variable that holds an address—that is, a memory space location). Aka
object dereference.
145
