Introduction

Question 1

What are the 4 components involved in building dependable systems?

Answer 1

Policy ( what you are supposed to achieve)
Mechanisms (measures and controls used to implement the policy)
Assurance (amount of reliance you can place on each mechanism and how well the mechanisms work together)
Incentive (motive of people guarding and maintaining the system to do their job properly and motive over attackers to jeopardise the policy)

Question 2

Define asset

Answer 2

Something that has value to the organisation (tangible or intangible)

Question 3

Define threat

Answer 3

Potential cause of an incident that may harm the assets of an organisation

Question 4

Define threat agent

Answer 4

Party that is responsible for opposing a threat to a system.
Could be human (intentional vs unintentional) or natural (e.g. disaster)

Question 5

Define vulnerability

Answer 5

A weakness in a system that can be exploited by a threat agent

Question 6

Define risk

Answer 6

The potential that a threat agent would exploit the vulnerability and adversely impact the system.
risk = impact * likelihood

Question 7

Define attack

Answer 7

Action of exploiting a vulnerability to compromise a system

Question 8

Define security policy

Answer 8

Set of rules that defined the assets to protect, the security objectives to achieve, the standards to follow and constraints of a security program

Question 9

Define security controls

Answer 9

Measures to protect a system according to a security policy

Question 10

Define confidentiality

Answer 10

Protecting information and assets from unauthorised access

Question 11

Define integrity

Answer 11

Ensuring accuracy and completeness of data and processes and protecting them from unauthorised modification

Question 12

Define availability

Answer 12

Ensuring that data and services are available to the system users and preventing unorganised impairment of functionality

Question 13

Define accountability

Answer 13

Actions can be traced to responsible users/entities

Question 14

Define non-repudiation

Answer 14

Committed actions cannot be denied by responsible actors

Question 15

Define authentication

Answer 15

Verifying the identity of the user of process to grant access to resources

Question 16

What are the types of security activities?

Answer 16

Source code auditing (manual or automated review of source code to identify flaws and sources of vulnerabilities)
Software component analysis (investigating third-party and source software components for security risks)
Vulnerability scanning (using automated scanners to identify potential vulnerabilities or flaws)
Vulnerability assessment (manual verification of vulnerabilities to confirm exposure, without exploiting)
Penetration testing (exploiting identified vulnerability to gain further access, simulating and attack)
Red teaming (holistic offensive approach to simulate how real world adversaries can attack a system)
Security audit (evaluation of security controls in relation to their compliance with security objectives, policies or standards)
Security review (verifying that security policy and standards have been applied through performing gap analysis and reviewing design/implementation documents, code reviews and testing reports)

Question 17

What are the types of security flaw classifications?

Answer 17

Input validation and representation
API abuse
Security features
Time and state
Errors
Code quality
Encapsulation
+1 Environment