My Memory Palace-2

Question 1

ISO/IEC 15288:2015

Answer 1

systems engineering standard covering processes and life cycle stages.

defines a set of processes divided into four categories:

1. Agreement
2. Organization Project-Enabling
3. Technical Management
4. Technical

Question 2

ISO 15408

Answer 2

Common Criteria, provides a structured methodology for documenting security requirements.

Use of the Common Criteria “protection profiles” and “security targets” greatly aids in the development of products and systems that have IT security functions.

Question 3

ISO/IEC 21827:2008

Answer 3

Systems Security Engineering – Capability Maturity Model (SSE-CMM)

describes the essential characteristics of an organization’s security engineering process that must exist to ensure good security engineering.

Question 4

Confinement (sandboxing)

Answer 4

ability to control read / write activity as software executes in a system and accesses memory

Question 5

Bounds

Answer 5

limits set on the memory addresses and resources a process can access in a system

Question 6

Isolation

Answer 6

the ability to use bounds and confinement to control the impact process behavior has on a system

Question 7

Controls (in the context of access)

Answer 7

use of access rules to limit subject / object interaction

Question 8

Trusted System

Answer 8

one where all protection mechanisms work together to process sensitive data for many types of users while maintaining a stable, secure environment

Question 9

Assurance

Answer 9

the degree of confidence or certainty in a system’s ability to satisfy the defined security requirements

Question 10

Vulnerability scanning

Answer 10

Just identify Weakness; Does NOT evaluate the amount of vulnerability that represents to the company.

Question 11

Different between permission and right

Answer 11

Permission - CRUD on object

Right - the ability to perform actions on a system.

Question 12

Fail-safe

Answer 12

systems provide the ability to automatically terminate processes in response to failure. example, an automated locking system that defaults to unlock in case of power failure.

Question 13

Fail-secure

Answer 13

state refers to the ability of a system to maintain and preserve the secure state of the system in the event of a system failure. Fail-secure state implies that a system should be able to protect itself and its information assets if critical processes are terminated & if system becomes unusable. I.e. automatic lock default to lock in case of power failure

Question 14

Fail-soft

Answer 14

is the termination of selected, non-critical processes after a hardware or software failure is detected.

Question 15

Black Box Testing

Answer 15

Combinatorial - every possible test cases/combination of Input testing

Pairwise Testing - a subset of Combinatorial, test two or more than one component at a time.

Fuzzing - Fuzz testing with various inputs.