exam Flashcards
What is the definition of computer security and what does it involve?
The protection of a computer system against theft and damage. Involves controlling physical access to hardware, malpractice by users and network access, bad data or code injection.
What is confidentiality?
Data is kept private or restricted by ensuring only authorised users can access it. More important when value of data depends on limiting access to it e.g. personal/financial info
What is integrity?
Data is kept accurate, authentic and reliable by ensuring only authorised users may modify it. More important when data must be accurate and consistent e.g. financial records
What is availability?
Data is available to authorised users when it is needed. More important when data must be seen or sent e.g. medical records
What is authentication?
Determining whether someone/something is what it declares itself to be.
What is non-repudiation?
Ensuring someone/something cannot deny or contest something (inability to refuse responsibility).
What is a: threat, vulnerability, risk?
Threat -> a potential negative action or event that could harm a computer system.
Vulnerability -> a weakness in a computer system that can be exploited by a threat to deliver a successful attack.
Risk -> potential for loss/damage when a threat exploits a vulnerability.
risk = threat x vulnerability
Why does computer security matter?
Computer systems are valuable targets.
Computer systems have many security threats.
Cyber crime is growing.
Cyber crime comes with a cost (economic, reputational and regulatory).
What are the two key programming paradigms?
Imperative -> describes how. Explicitly specifying step-by-step instructions which change the program’s state. Usually has more lines of code. Provides flexibility but brings in complexity. Structural, procedural, object-oriented.
Declarative -> describes what. Overall control flow; doesn’t specify. Allows more readable code to be written that reflects exactly what we want to see. Less lines, hides complexity and provides simplicity. Functional and logic.
Other paradigms include scripting, event-driven and DB querying.
What is an injection (input validation) attack?
An attacker submits malicious input which then gets injected into a genuine query or command that is subsequently processed. Can cause data loss, alterations, denial of service or even full system compromise.
What is an SQL injection attack?
Consists of inputting malicious SQL code which is inserted into genuine SQL commands to: read sensitive data from DB, modify DB data, execute admin operations (e.g. shut down DBMS), access sensitive file or issue commands to OS.
What is a Cross-Site Scripting (XSS) attack?
Involves injecting malicious scripts into vulnerable web applications which are delivered to user’s systems. Included with dynamic content delivered as markup text to a victim’s browser, taking advantage that browsers can’t distinguish and will execute whatever markup they receive. Can spread malware, deface websites, disrupt social networks, phish for credentials and cause more damaging attacks with the addition of social engineering techniques.
What is bounds checking?
a method of detecting whether a variable is within some bounds before it is used. Used for index checks. A failed check usually produces some kind of exception signal.
What is a buffer overflow attack?
forces a program to put more data in an array/buffer than it can hold, putting extra data in a memory area past a buffer. This can corrupt/overwrite existing data, crash program or cause execution of malicious code (forcing an out of bounds write can force an out of bounds read).
What is a format string attack?
a submitted input string is evaluated as a command by the application to cause some malicious action. Takes advantage of format specifiers referring to the stack and reading the next variable. Variable values, return addresses, parameters user input data or pointer memory addresses can be revealed.
What is an integer overflow attack?
integer value forcibly incremented to a value to large to store in the associated representation. Wraps to a very small or negative number. Security critical when result is used to control looping, make a security decision or determine the offset size in behaviours such as memory allocation, copying, concatenation etc.
What is input validation?
proper checking or testing of any input supplied by the user or application to ensure it meets permitted input criteria (validation characteristics). Should occur when data is received from an external party, especially if untrusted.
What are the two types of input validation?
Whitelisting -> defines allowed input data while any other input data is denied by default.
Blacklisting -> defines unallowed input data while any other input data is allowed by default.
What are data fields used for?
validating input data is of the type wanted when implementing web forms. They help prevent users from submitting the wrong type of data in particular input fields.
What is a Cross-Site Request Forgery (CSRF) attack? What is a CSRF token?
tricking an authenticated user into sending a malicious request not generated via the user interface. A CSRF token is a random, unguessable string used to validate the origin of the request.
What is a session?
a group of user interactions with a web application within a given time frame. Session data is stored as a session cookie in the user’s browser.
What is a secret key used for?
used for encryption tasks such as cryptographically signing session cookies and generating a CSRF token.
What are validator class instances used for?
checking or validating input data values in a Form class. Can be in-built or custom. Must all return True for form’s input data to be submitted to the web application.
What is pattern matching?
a technique to check a requirement of characters in an inputted string needing to follow some specific pattern or sequence.
What is a regular expression?
a string of text defining a pattern or sequence ( a search pattern). Regex is used for pattern matching. May include metacharacters, sets or special sequences. When matching, the regex engine pointer steps along a given string and checks each character (order is important).
Why might a lookahead be used?
to check for the existence of characters within an inputted string. Can be chained to look for multiple somethings.
What is error handling used for?
gracefully handling software errors and helping execution to resume when interrupted.
Why is it better to have self-generated error messages than externally-generated (automatic) ones?
Automatically generated error messages can contain sensitive info: private/personal info; system status and environment; network status and configuration; app’s own code or internal state. Having the source code explicitly construct messages prevents information leakage.
What are the disadvantages of hardcoding data?
Considered anti-pattern - requires source code to be changed.
Hard to adapt - hardcoding file paths makes adapting to another location difficult.
Hard to internationalise - harcoding of messages make it difficult.
Raises security vulnerabilities.
What security concern does source code disclosure raise?
attackers can check for logical flaws or harcoded data to better understand how the application behaves.
What are hidden form fields for?
used in web pages to pass information to be sent to the server, along with form data, without the user having to be involved in the process. Can also pass info to scripts e.g. security tokens. Being able to view a hidden field when inspecting source can reveal sensitive values.
What is reverse engineering and why is it usually used?
reversal of a program’s machine code back into source code it was written in. Used:
because source code was lost
to study how program performs certain operations
to improve performance of a program
to fix a bug
to identify malicious content
to adapt program for a different microprocessor
Why is a .env file used?
used to remove and store sensitive environmental variables separately from the source code e.g. secret keys
What are best practices to secure DBs?
have separate web and DB servers
use firewalls
secure DB user access
regularly update OS and patches
audit and continuously monitor DB activity
test DB security
avoid using default network ports
encrypt data and backups
What is authentication and an authentication factor?
the process of validating the identity of a registered user before allowing authorised access to protected resources. An authentication factor is a category of evidence that a person has to present to prove their identity: knowledge, possession or inherence. Always comes before authorisation.
