Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

- > Domain 8: Software Development Security > Flashcards

Domain 8: Software Development Security Flashcards

1
Q

Types of programming languages

A
  1. Interpreted Languages: such as Python, R, and Javascript. This is where the source code itself is distributed and the interpreter executes the source code on their system.
  2. Compiled Languages: Such as C and Java, they must be compiled before use in an executable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Key phases of SDLC

A

5 Key Phases:

  1. Initiation
  2. Development/acquisition
  3. Implementation/assessment
  4. Operation/maintenance
  5. Disposal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is initiation (SDLC)?

A

Process of determining feasibility, cost, risk analysis, getting management approval, and establishing basic security objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is development/acquisition phase (SDLC)?

A

Define security architecture, perform risk assessment, determine initial security controls and countermeasures, and document security controls and concept of operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is implementation/assessment (SDLC)?

A

Test, evaluate and deploy the new system into operations. This includes performing a security assessment to determine security posture, implementing corrective actions to weak security controls, and getting certification and accreditation for the new system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the software development life cycle? (conceptually)

A

A process designed for the planning, creating, testing, and deploying of an information system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is operations/maintenance phase (SDLC)?

A

System maintenance, includes readiness review to ensure everything is ready to go. Also focuses on configuration management and change control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is disposal phase (SDLC)?

A

System is decommissioned or taken out of operations for termination, upgrade, or replacement. Focus is on the planning for the transfer, protection, or proper destruction of documentation, hardware, and/or software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Three key phases of Change Management process?

A
  1. Request control,
  2. Change control
  3. Release control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain Request Control

A

Provides an organisation framework within which users can request modifications, managers can conduct cost/benefit analysis, and developers can prioritise tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Explain Change Control (Change Management)

A

Provides an organised framework within which multiple developers can create and test a solution prior to rolling it out into a production environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Explain Release Control (Change Management)

A

Once the changes are finalised, they must be approved for release through the release control procedure. Focus is on removing programming aides (such as back doors) and ensure acceptance testing is performed before release.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of the Configuration Management Process?

A

Used to control the version(s) of software used throughout an organisation and formally track and control changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define Configuration Identification (Configuration Management process)

A

Administrators document the configuration of covered software products throughout the organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define Configuration Control (Configuration Management process)

A

Ensures that changes to software versions are made in accordance with the change control and configuration management policies. Updates can be made only from authorised distributions in accordance with these policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Configuration Status Accounting

A

Formalised procedures are used to keep track of all authorised changes that take place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Configuration Audit?

A

Periodic configuration audit should be conducted to ensure that the actual production environment is consistent with the accounting records and that no unauthorised configuration changes have taken place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define Software Capability Maturity Model (SW CMM)

A

It is a 5 level software development maturity model that describes procedures, principles, and practices that underlie software development process maturity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define 5 levels of SW CMM

A
  1. Initiating: competent people, informal processes, ad-hoc, absence of formal process
  2. Repeatable: project management processes, basic life-cycle management processes
  3. Defined - engineering processes, presence of basic life-cycle management processes and reuse of code, use of requirements management, software project planning, quality assurance, configuration management practices.
  4. Managed: product and process improvement, quantitatively controlled
  5. Optimising: continuous process improvement works with an IDEAL model
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define IDEAL model

A

Organizational improvement tool/model, including:
I: Initiate, begin effort. Outline business reasons behind change, support is built for the initiative, and the appropriate infrastructure is put in place.
D: Diagnose, perform assessment of current state and make recommendations.
E: Establish an action plan
A: Implement action plan, including develops solutions and then tests, refines, and implements them.
L: Leverage assessments, and continuously improve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define Gantt Chart and PERT

A

Gantt Charts are a bar chart for project planning timings (including when things are planned to happen). While, PERT is Program Evaluation Review Technique for project scheduling used to judge the size of a software product in development and calculate the standard deviation (SD) for risk assessment. PERT is used to direct improvements to project management and software coding in order to produce more efficient software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define DevOps

A

An approach which aims to resolve issues by bringing the three functions of Software Development, Quality Assurance, and IT Operations together. It is not focused on security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Types of Software Development Models

A
  1. Simplistic: model of continual steps in order
  2. Waterfall: System Requirements –> Software Requirements –> Analysis –> Program Design –> Coding –> Testing –> Operations and Maintenance
  3. Waterfall including Validation and Verification (V&V):. Validation = doing the right job, and verification=doing the job right. This model allows the validation and verification of software at all levels during production.
  4. Spiral Model: Encapsulates a number of iterations of the Waterfall model, including, determining objectives, alternatives, and constraints –> evaluate alternatives, identify and resolve risks –> plan next phases –> and develop and verify next-level product.
  5. Cleanroom: write code correctly first time, quality through design
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Agile Software Development

A

It is an approach to delivering software, with working software being a primary measure of success

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Define database

A

General mechanism for defining, storing and manipulating data without writing specific programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

DBMS

A

Database Management System, is a suite of software programs that maintains and provides controlled access to data components stored in rows and columns of a table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Types of databases

A

Hierarchical= tree (sons with only one parent), one to many relationship
Network=tree (all interconnected)
Relational= one-to-one relationships, has has tuples and attributes (rows and columns)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

DDL and DML

A

DDL=Data definition language which defines strucutre and schema
DML=Data Manipultion Manguage: view, manipulate, and use the database via VIEW, ADD, MODIFY, SORT, and DELETE commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Degree of DB

A

Number of attributes (columns) in table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Tuple

A

Row or record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

DDE

A

Dynamic Data Exchange: enables applications to work in a client/server model by providing the inter-process communications mechanism (IPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

DCL

A

Data control language: subset of SQL used to control access to data in a database, using GRANT and REVOKE statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Semantic integrity

A

Makes sure that the structural and semantic rules are enforced on all data types, logical values that could adversely affect the structure of the database. Only allows allowable data to be entered into a row.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Referential integrity

A

All foreign keys reference existing primary keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Candidate Key

A

An attribute (column) that is a unique identifier, that could be chosen to be a primary key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Primary Key

A

A unique attribute to identify a record in a database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Foreign Key

A

Represents a record in another table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Main components of DB

A

Schemas (blueprints), tables, and views

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Incorrect summaries

A

When one transaction is using an aggregate function to summarise data stored in a DB while a second transaction is making modifications to a DB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Dirty reads

A

When one transactions reads a value from a DB that was written by another transaction that did not commit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Lost updates

A

When one transaction writes a value to the DB that overwrites a value needed by transactions that have earlier precedence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Dynamic Lifetime Objects

A

Objects created on the fly by software in a OOP environment. An object is preassembled code that is a self-contained module.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

ODBC

A

Open database connectivity is a DB feature that allows applications to communicate with different types of DBs without having to be directly programmed for interaction with each type. ODBC acts as a proxy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Multilevel security

A

Keeping data with different security requirements separate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Database contamination

A

Mixing data with different classification levels andor need to know requirements and is a significant challenge.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Database partitioning

A

process of splitting a single database into multiple parts, each with a unique and distinct security level or type of content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Polyinstantiation

A

Occurs when two or more rows in the same relational database table appear to have identical primary key elements but contain different data for use at differing classification levels. it is often used as a defense against inference attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is the ACID Model? (conceptually)

A

Critical database theory model to create reliable databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Atomicity

A

Database transactions must be atomic - they must be an ‘all or nothing’ affair. If any part of the transaction fails, the entire transaction must be rolled back as if it never occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Consistency

A

All transactions must begin operating in an environment tht is consistent with all of the database’s rules (for example, all records must have a unique primary key).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Isolation

A

Transactions operate separately from each other, in order.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Durability

A

Database transactions must be durable, once they are committed to the database, they must be preserved, such as through the use of backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Expert Systems: Knowledge Management

A

Embody accumulated knowledge of experts on a particular subject and apply it in a consistent fashion to enter decisions. Expert system = inference engine + knowledge base - degree of uncertainty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Two components of expert system

A

Knowledge base and inference engine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Knowledge base

A

Set of rules such as if-then statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Inference system

A

Analyses information in the knowledge base to arrive at the appropriate decision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Two modes of expert systems

A

Forward Chaining: acquires info and comes to a conclusion

Backward Chaining: backtracks to determine IF a hypothesis is correct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Neural Networks

A

Use complex computations to replace partial functions of the human mind and works with weighted inputs. Single Layer = only one level of summoning codes
Multi Layer = more levels of summoning codes

59
Q

Programming Languages Generations

A

5 Generations, including:

  1. Include all machine languages
  2. Include all assembly languages
  3. Include all compiled languages
  4. Attempt to approximate natural languages and include SQL, for DBs
  5. Allow programmers to create code using visual interfaces.
60
Q

Programming Languages tools

A

Compiler: translates higher level program into an executable file
Interpreter: reads higher level code, one line at the time to produce machine instructions
Assembler: converts machine-code into binary machine instructions.

61
Q

Object oriented security

A

Behave as a black box, as they are encapsulated to perform an action. Can be substituted if they have compatible operations. it can store objects like video and pictures

62
Q

Encapsulation for Software development

A

Only data it needs, no accidental access to data

63
Q

Message

A

Communication to object to perform an action

64
Q

Method

A

Code that defines an action an object performs in response to a message

65
Q

Behaviour

A

Results exhibited by an object in response to a message

66
Q

Class

A

Collection of methods that defines the behaviour of objects

67
Q

Instance

A

Objects are instances of classes that contain their methods

68
Q

Inheritance

A

Allows a subclass to access methods belonging to a superclass

69
Q

Polymorphism

A

Objects of many different classes that are related by some common super class. When different subclasses may have different methods using the same interfaces that respond differently

70
Q

Object Orientation: Requirements Analysis (OORA)

A

Defines classes of objects and their interactions

71
Q

OOA, Analysis

A

Understanding and modelling a particular problem Domain Analysis (DA) seeks to identify classes and objects that are common to all applications in a domain

72
Q

OOD, Design

A

Objects are the basic units, and instances of classes

73
Q

OOP, Programming

A

Employment of objects and methods. If class = airplane, objects like fighter plane, cargo plane, passenger plane can be created. Method would be what a plane would do with a message like: climb, dive, and roll.

74
Q

Object Request Brokers

A

Middlewear that acts as locators and distributors of the objects acros networks

75
Q

CORBA: Standard

A

Broker architecture enables programmes wittten in different languages and using different platforms and OS’s through Interface Definition Languae

76
Q

Common Object Model

A

Support exchange of objects amongst programs. This used to be called OLE. DCOM is the network variant.

77
Q

Conclusion

A

Object Orientation supports reuse of objects and reduces development risk, natural in its representation of real world entities

78
Q

Cohesion

A

Ability to perform without use of other programs, strength of the relationship between the purposes of methods within the same class

79
Q

High cohesion

A

Without use of other modules

80
Q

Low cohesion

A

Must interact with other modules

81
Q

Coupling

A

Effect on other modules. Level of interaction between objects

82
Q

High coupling

A

Module largely affects many more modules

83
Q

Low coupling

A

Doesnt affect many other modules

84
Q

Abstraction

A

Fundamental principle of OOP. Users of an object (or OS component) doesnt necessarily need to know the details of how the object works; they need to know just the proper syntax for using the object and the type of data that will be returned as a result

85
Q

Seperation of privilege

A

Builds on principle of least privilege. Requires the use of granular access permissions; that is, different permissions for each type of privileged operation. Allows admins to do certain privileged functions, without complete access to system.

86
Q

Process isolation

A

Requires that the OS provide separate memory spaces for each process’s instructions and data. It also requires that the OS enforce those boundaries, preventing one process from reading or writing data that belongs to another process. This prevents unauthorised data access, and protects the integrity of processes.

87
Q

Layering processes

A

Implementstrucutre similar to the ring model

88
Q

Hardware segmentation

A

Similar to process isolation, by seperating physical hardware

89
Q

Covert Channels

A

A way to receive information in an unauthorised manner, information flood that is not protected by a security mechanism.

90
Q

2 Types of Covert Channels

A
  1. Storage Covert Channel: Processes communicate via storage space on the system. For example, writing to storage by one process and reading by another of lower security level.
  2. Covert Timing Channel: One process relays to another by modulating its use of system resources. Typing rhythm of Morse Code is an example.
91
Q

Mobile Code: Java

A

Sandboxes, no warnings, programs are compiled to bytecode

92
Q

Mobile Code: ActiveX

A

Authenticode, relies on digital signatures, annoying dialogs people click away

93
Q

Malicious Code; Virus

A

Inserts or atteches itself to file, and is spread through infected media

94
Q

Worm

A

Reproduces on its own without user action

95
Q

Logic Bomb/Code bomb

A

Executes when a certain event happens (like accessing a bank account or employee being fired) or a data/time occurs

96
Q

Trojan Horse

A

Program disguised as a useful program/tool

97
Q

Hoaxes

A

False warnings like

98
Q

Remote Access Trojan (RAT)

A

Remote control programs that have the malicious code and allow for unauthorised remote access, back orifice, sub even, net bus

99
Q

Buffer Overflow

A

Excessive information provided to a memory buffer without appropriate bounds checking which can result in an elevation of privilege. if executable code is loaded into the overflow, it will be run as if it were the program. . Must be corrected in code

100
Q

Backdoor

A

Program installed by an attacker to enable him to come back at a later date without going through proper authorisation channels, maintenance hook for developers

101
Q

Countermeasures

A

EAL6 systems have less than EAL3 systems because covert channels are normally a flaw in design

102
Q

LOKI

A

Tool used for covert channel that writes data directly after the ICMP header.

103
Q

Botnet

A

Thousands of zombie computers

104
Q

Directory Traversal Attack

A

Attacker attempts to force the web application to navigate up the file hierarchy and retrieve a file that should not normally be provided to a web user.

105
Q

Macro virus

A

Most common in office productivity documents, .doc/.docx.

106
Q

Trojans

A

Pretends to do one thing, while performing another

107
Q

MDM

A

Software solution to manage the myriad mobile devices that employees use to access company resources. The goals of MDM are to improve security, provide monitoring, enable remote management, and support troubleshooting.

108
Q

Collisions

A

Two different files produce the same result from a hashing operation

109
Q

Boot sector

A

Moves or overwrites the boot sector with the virus code

110
Q

System infector

A

Infects BIOS command, or other system files. It is often a memory resident virus

111
Q

Phlashing

A

Malicious variation of official BIOS or firmware is installed that introduces remote control or other malicious features into a device

112
Q

Compression

A

Append to executables

113
Q

Companion Virus

A

Specific type of virus where the infected code is stored not in the host program, but in a separate ‘companion files’

114
Q

Stealth Virus

A

Hides modification to files or boot records and itself

115
Q

Multipart virus

A

Infects both boot sector and executable files, becomes resident first in memory and then infects the boot sector and finally the entire system, uses two or more propagation mechanisms

116
Q

Self-garbling virus

A

Attempts to hide by garbling its code; as it spreads, it changes the way its code is encoded

117
Q

Polymorphic virus

A

Self garbling virus that changes its pattern each time it spreads

118
Q

Macro virus

A

Usually written in Word Basic, VBScript and used with MS Office

119
Q

Resident virus

A

Virus that loads when a program loads in memory

120
Q

Resident virus

A

Virus that loads when a program loads in memory

121
Q

Master Boot Record

A

MBR virus attacks the MBR, and virus is stored on another part of memory that is loaded at boot-up

122
Q

Non-resident virus

A

Attached to .exe

123
Q

Signature Based Anti Virus

A

Cannot detect new malware, relies on knowledge of existing malware

124
Q

Heuristic behaviour based Anti Virus

A

Can detect behavior of misbehaving files

125
Q

Protected Domain

A

Execution and memory space assigned to each process

126
Q

Trusted Computer Base

A

Combination of protection systems within a computer system, which includes the hardware, software and firmware that are trusted to enforce the security policy

127
Q

Security Kernel

A

Hardware, software, firmware, elements of TCB that implement the reference monitor concept - must be isolated from reference monitor

128
Q

Reference Monitor

A

Isolation, completeness and verifiability, that compares the security labels of subjects and objects

129
Q

Multistate systems

A

Capable of implementing a much higher level of security. These systems are certified to handle multiple security levels simultaneously by using specialised mechanisms.

130
Q

Protection Rings

A

4 Protection Rings
Ring 0: OS Kernel. Kernel manages the HW and supplies fundamental services that the HW does not provide.
Ring 1: Remaining parts of OS
Ring 2: I/O drivers and utilities
Ring 3: Applications and programs
Layers 1 and 2 contain device drivers but are not normally implemented in practice. Layer 3 contains user applications. Layer 4 does not exist.

131
Q

CSRF (XSRF)

A

Cross Site Request Forgery, attacks exploit the trust that sites have in a user’s browser by attempting to force the submission of authenticated request to third party sites

132
Q

Cross Site Scripting

A

Uses reflected input to trick a user’s browser into executing untrusted code from a trusted site

133
Q

Session Hijacking

A

Attempt to steal previously authenticated sessions but do not force the browser to submit request

134
Q

SQL injection

A

Directly attacks a DB through a web app

135
Q

BSOD

A

When Windows crashes into a dangerous failure and enters a full secure state (reboot)

136
Q

Patch management system

A

Prevents outages from known attacks by ensuring systems are patched. Patches aren’t available for new attacks

137
Q

Threat modelling

A

Reduces the number of security related design and coding flaws, reduce severity of non-security related flaws, not to reduce number of threat vectors

138
Q

Open system

A

One with published APIs that allow third parties to develop products to interact with it

139
Q

Closed system

A

One that is propeitary with no third-party product support, does not define if its code can be viewed

140
Q

Open source

A

Coding stance that allows others to view the source code of a program, distributed free or for a fee

141
Q

Closed source

A

Is an opposing coding stance that keeps source code confidential. Can be reverse engineered or decompiled

142
Q

Verification

A

Evaluates the product against specifications

143
Q

Validation

A

Evaluates how well the product satisfies real-world requirements

- (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions