Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

software security > Information security, concepts and principles > Flashcards

Information security, concepts and principles Flashcards

1
Q

How can software security be defined?

A

The practice of building software to be secure and to continue to function properly under malicious attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Is data privacy and data security the same?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is data privacy?

A

Compliance with data protection laws and regulations. Focuses on how to collect, process, share, archive and delete the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is data security?

A

Measures that an organization is taking in order to prevent any third party from unautherized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are some causes of insecure code being deployed?

A

Pressure of meeting deadlines. Instead create plans of dealing with them later.

Developers lack knowledge to mitigate issues identified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How many companies suffered from successful cyberattacks last year?

A

86%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How many organizations are experiencing an IT security skill shortfall?

A

87%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Name 6 examples of threats and attacks

A

Web defacement

Infiltration, control hijacking

Phishing

Data theft / Data loss

DoS

Ransomware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is web defacement?

A

Replace legitimate pages with illegitimate ones.

An attack on webpages that change the visual appearance of the page. This can be done by attackers who hack into servers and replaces hosted websites with malware or a website of their own.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is malware?

A

Malicious software.

Software that is created to cause harm on a computer, server, client or network, such as gain authorized access or steal/leak data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are Trojan horses?

A

Malware that disguise itself as a standard program, effectively misleading users of its true intent.

Examples are malicious email attachments or fake advertisements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Infiltration

A

Attacks where an attacker gains unauthorized access to a service.

Infiltration can consist of acts such as secretly entering, observing, or extracting sensitive information from a secure system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is control hijacking?

A

An attacker want so gain control of a machine, such as a webserver, by executing arbitrary code on the target. This can be done if the attacker is able to hijack the normal application control flow.

buffer- and integer overflows
format vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is phishing?

A

The attacker masquerades as a reliable source to lure the victim into giving up information such as usernames, passwords, and other sensitive information.

Attack vectors: Email, sms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Data theft / Data loss attacks?

A

Unautherized acquisition. transfer or storage of confidental information belonging to an entity.

Attackers may want to sell the stolen information to other malicious parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are DoS attacks?

A

Attacks that affect the availability of a service. These attacks can be carried out by overflowing a server with packets, causing it to drop legitimate packets and becoming unavailable to legit users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is ransomware?

A

Malware designed to block access to a computer system, or data, until a sum of money is payed.

A way of doing this is for an attacker to encrypt all of an entity’s data, and demand a ransom in exchange for the decryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the CIA triad?

A

Confidentiality

Integrity

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are 3 security goals, additional to the CIA triad?

A

Privacy

Accountability

Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is confidentiality?

A

Keeping data or communication secret. Preventing unautherized access to data or services.

21
Q

How can confidentiality be achieved?

A

Cryptography
Authentication
Authorization
Sealed envelopes

22
Q

What is integrity?

A

Protection from unautherized modification and deletion of systems.

23
Q

What is data integrity?

A

No corruption of data

24
Q

What is control integrity?

A

No control hijacking

25
Q

How can integrity be achieved?

A

Message/data hashing (MAC)

26
Q

What is availability?

A

Regards the uptime and response time of a system.

Can also be seen in regards to how much free storage space a system has.

27
Q

What is privacy?

A

Right to be left alone.

The ability for individuals to control what and how information about them are stored, processed, shared and communicated to others.

28
Q

How is integrity and confidentiality different?

A

Integrity: Who can modify data
Confidentiality: Who can read the data

29
Q

How is privacy and confidentiality different?

A

Confidentiality: The secret of business information
Privacy: The protection of personal information

30
Q

What is accountability?

A

Being able to track an incident or action down to a single entity.

31
Q

How can accountability be achieved?

A

Secure timestamping

Data integrity in logs

audit trails

32
Q

What is secure timestamping?

A

Securely keeping track of creation and modification time of data, or other actions.

33
Q

What are audit trails?

A

Audit trails stores records of system activity by processes and users.
They keep track of actions that have taken place.

34
Q

What is non-repudiation?

A

A party cannot deny creation of communication, or deny receipt of communication.

35
Q

How can non-repudiation be achieved?

A

Using signatures

36
Q

Name the 10 security guiding principles

A
  1. Secure the weakest link
  2. Practice defense in depth
  3. Fail securely
  4. Compartmentalize
  5. Be reluctant to trust
  6. Follow the principle of least privilege
  7. Keep it simple
  8. Promote privacy
  9. Remember that hiding secrets is hard
  10. Use your community resources
37
Q

What does the 1st security principle mean: Secure the weakest link.

A

Security is as strong as the weakest link.

Attacker only have to find one flaw, the developers need to cover all possible flaws

38
Q

What are some common weak links?

A

Weak passwords
People (Social engineering attacks, internal attacks)
Poor software

39
Q

What does the 2nd security principle mean: Practice defense in depth

A

Do not rely on one-shot security, have layers of defense.

Should have layers of protection, detection containment (emergency response plan) and recovery.

Firewall + authorization + authentication + cryptography, etc.

Swiss cheese model

40
Q

What is the swiss cheese model?

A

A model used in risk analysis and risk management. Is the principle behind layered security.

41
Q

What does the 3rd security principle mean: Fail securely

A

Expect failure of security features. There are two types of errors.

Exceptions that occur in the processing of a security control itself. These must not enable behaviour that the countermeasure would normally not allow. The failure should allow the same executing path as disallowing the operation. I.e. if firewall break - let no traffic in.

The other excpetions are in code that is not part of a security control. These are security relevant if they affect whether the application properly invokes the control. An exception can for example prevent a security method to be invoked when it should.

42
Q

What does the 4th security principle mean: Compartmentalize

A

Separate something (e.g. code) into parts.

Don’t mix those parts. For example, separate network into different zones. Run sensitive applications on separate computers.

43
Q

What does the 5th security principle mean: Be reluctant to trust

A

Skepticism is always good. Don’t trust any code library.
Should not trust or assume the validity of user inputs (sqli, xss)

44
Q

What does the 6th security principle mean: Follow the principle of least privilege

A

Use minimum access to get a job done.
Let services be active for the minimum amount of time necessary. (inactive user for a while -> log out)

45
Q

What does the 7th security principle mean: Keep it simple

A

Make systems simple. This will reduce the attack surface. Less functionality gives less security exposure. All unecessary features/functions should be turned off and close unecessary ports.

There is a tradeoff between relative security and slight inconvenience. (e.g. 2FA)

46
Q

What does the 8th security principle mean: Promote privacy

A

Do not compromise the privacy of the user.

Though some information might be “nice-to-have” if it is not necessary, it should not be stored.

47
Q

What does the 9th security principle mean: Keeping secrets is hard

A

Should not rely on security by obscurity. Attackers can find ways to probe for information or weaknesses.

Open vs. close source should be a business decision, not a security one.

48
Q

What does the 10th security principle mean: Use your community resources

A

Actively use websites and sources of information.

Be updated with “known threats” and vulnerabilities.

software security (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions