Security Engineering Flashcards

1
Q

Takes place when too much data is accepted as input to a specific process.

A

Buffer Overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A countermeasure for buffer overflow.

A

Bounds Checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The term for when an app does not release the memory it is using so that it is available to other apps.

A

Memory Leak

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Name two counter measures for memory leak.

A

Garbage Collectors

Better code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When trying to access memory, CPU uses ____________ addresses. Applications use ______ addresses.

A

Physical

Logical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The ___________ acts like NAT for physical and logical memory addresses thereby providing security and efficiency.

A

Memory Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This type of memory is used for high speed write and read activities.

A

Cache Memory

ex. L1, L2, L3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are two types of multitasking

A

Cooperative (process must voluntarily release resources)

Preemptive (OS controls how long each app can use a resource.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is multi-threading?

A

The ability to perform more than one thread (instruction set) at one time.

OS can perform multi-threading, however, multiple cores in a processor allow multi-threading at a hardware level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the two types of multiprocessing and how do they differ?

A

Symmetric - like load balancing. Processors are handed work as needed.
Asymmetric - A processor is dedicated to a specific application or work load.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the two main CPU modes?

A

User (Problem State)

Privileged (Kernel Mode)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

If the CPU needs to access some data either from memory or or from an I/O device, it sends a fetch request down the ___________ bus.

A

Address bus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Circuitry associated with the memory or I/O device receives a fetch request and recognizes the address the CPU sent down the address bus and instructs the memory or device to read the requested data and put it on the _______ bus.

A

Data bus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Special registers hold info like the program counter and the _________ , which holds different condition bits that indicate whether the CPU should be working in user mode or privileged mode.

A

Program Status Word (PSW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does “Random Access” mean in Random Access Memory?

A

Random Access Memory allows you to access information non-sequentially.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the difference between SRAM and DRAM?

A

Static RAM (SRAM) does not have a continuous refresh of electrons. Dynamic RAM (DRAM) the capacitors must be constantly refreshed. SDRAM is more expensive than DRAM and is typically used in cache.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Types of ROM in order

A

Read-Only Memory - Nonvolatile memory type.
Programmable read-only memory PROM - Only programmable one time.
Erasable programmable read-only memory EPROM - UV light needed to “flash” (erase) the memory.
EEPROM - Electronically erasable PROM, no UV light needed, but slow.
FLASH MEMORY - Easy to update (both good and bad!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is ASLR?

A

Address Space Layout Randomization. Introduced in Windows Vista (originally on OpenBSD).
Helps protect stuff in memory by making it harder to figure out where to attack it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is DEP?

A

Data Execution Prevention. Marks certain memory locations as “off-limits.”

20
Q

What are the two categories of interrupts?

A

Maskable interrupt - for process that is not overly important
Non-maskable interrupt - Can never be overridden.

21
Q

What are four methods of process isolation?

A

Encapsulation of objects (provides data hiding, talk to the API !!)
Time multiplexing of shared resources (OS coordinates different requests from different processes)
Naming distinctions (PIDs)
Virtual memory mapping

22
Q

Secondary storage, such as the hard drive, can be combined with RAM to provide virtual memory. What is the reserved hard drive space called and what is a security vulnerability to concerning encrypted data?

A

Swap space.

Any encrypted data is unencrypted before it is placed on the swap space.

23
Q

What I/O interrupt type is the safest?

A. Fully Mapped I/O
B. I/O using DMA
C. Premapped I/O
D Programmable I/O

A

Fully Mapped I/O

24
Q

Which OS architecture has all the operating system processes running in kernel mode?

A. Monolithic
B. Layered
C. Microkernel
D. Hybrid microkernel

A

Monolithic

25
Q

Which OS architecture has all the OS processes run in a hierarchical model in kernel mode?

A. Monolithic
B. Layered
C. Microkernel
D. Hybrid microkernel

A

Layered

26
Q

Which OS architecture has all the operating system processes running in kernel mode, with core processes running within a micro kernel and others running in a client\server model?

A. Monolithic
B. Layered
C. Microkernel
D. Hybrid microkernel

A

Hybrid microkernel

27
Q

A virtual machine is commonly referred to as a _______ that is executed in the ________ environment. The VMs communicate with a __________ within the host environment, which is responsible for managing system resources.

A

Guest
Host
Hypervisor

28
Q

The _________ is the hardware, firmware, and software of the Trusted Computing Base (TCB) that implements the concept of the reference monitor.

A

Security Kernel

29
Q

A ___________ is a concept in which an abstract machine mediates all access to objects by subjects.

A

Reference monitor

30
Q

This security model provides and addresses confidentiality only with three main rules:

  • Simple security rule
  • *-property (star property rule)
  • Strong star property rule

Also, the “tranquility principle.”

A. Brewer and Nash Model
B. Bell-LaPadula Model
C. Clark-Wilson Model
D. Biba Model

A

Bell-LaPadula Model

  • Simple security rule - Subject can not read data at a higher security level.
  • -property (star property rule) - Subject can not write data to a lower security level.
  • Strong star property rule - Subject with read/write permissions can only do those at the same security level.

-Strong tranquility - The security levels of an object should never change.

31
Q

This security model addresses integrity only within a system with the following three main rules:

*-integrity axiom
Simple integrity axiom
Invocation property

A. Brewer and Nash Model
B. Bell-LaPadula Model
C. Graham-Denning Model
D. Biba Model

A

Biba Model

*-integrity axiom - No write up
Simple integrity axiom - No read down
Invocation property - A subject can not invoke a service at a higher integrity level.

32
Q

This security model is implemented to protect the integrity of data and to ensure that properly formatted transactions take place.

  • Subjects can access objects only through authorized programs (access triple)
  • Separation of duties
  • Auditing is required

A. Brewer and Nash Model
B. Bell-LaPadula Model
C. Clark-Wilson Model
D. Biba Model

A

Clark-Wilson Model

Access triple is like the User -> Interface -> Backend

33
Q

Also known as the Chinese Wall model, this security model allows for dynamically changing access controls that protect against conflicts of interest.

A. Brewer and Nash Model
B. Graham-Denning Model
C. Clark-Wilson Model
D. Biba Model

A

Brewer and Nash Model

34
Q

This security model shows how subjects and objects should be created and deleted. It also addresses how to assign specific access rights.

A. Brewer and Nash Model
B. Bell-LaPadula Model
C. Graham-Denning Model
D. Biba Model

A

Graham-Denning Model

35
Q

________ is the international standard that is used as the basis for the elavulation of security properties of products under the Common Criteria (CC) framework.

A

ISO/IEC 15408

36
Q

_________ is the technical evaluation of a system or product and its security components for the purpose of accreditation.

A. Certification
B. Assurance Evaluation
C. Accreditation
D. Auditing

A

Certification

Moving away from C&A and toward Continuous Monitoring.

37
Q

__________ is managements formal approval and acceptance of the security provided by a system.

A. Certification
B. Assurance Evaluation
C. Accreditation
D. Auditing

A

Accreditation

Moving away from C&A and toward Continuous Monitoring.

38
Q

What is a maintenance hook?

A

A backdoor used by developers. Should be removed b4 release.

39
Q

This type of attack takes advantage of the dependency on the timing of events that take place in a multitasking operating system. The attacker jumps in between two tasks and modifies something to control results.

A

Time-of-Check/Time-of-Use (TOC/TOU)

40
Q

This type of attack makes processes execute out of sequence to control results.

A

Race Condition

41
Q

What is a countermeasure for race condition attacks?

A

Atomicise processes

42
Q

What is a countermeasure for Time-of-Check/Time-of-Use attacks?

A

Software locks on files.

Harder to put software locks on database components.

43
Q

Which of the following is not a component of ICS?

A. Distributed Control System
B. Programmable Logic Controllers
C. Embedded Systems
D. Supervisory Control and Data Acquisition

A

Embedded Systems

44
Q

A SCADA system involves three kinds of devices: endpoints, backends, and user stations. What components are used for these?

A

Endpoints - Remote Terminal Unit (RTU) or PLCs
Backends - Data acquisition servers (DAS)
User stations - Human-machine interface (HMI)

45
Q

The CPU uses this to keep track of where it is in the memory stack

A. Program Counter
B. Stack Pointer
C. Return Pointer
D. Stack Counter

A

B

46
Q

This register contains the memory address of the next instruction to be fetched.

A. Program Counter
B. Stack Pointer
C. Return Pointer
D. Stack Counter

A

A

47
Q

This formal multi-level security model states that commands and activities performed at one security level should not be seen by, or affect, subjects or objects at a different security level.

A. Brewer and Nash Model
B. Noninterference Model
C. Graham-Denning Model
D. Biba Model

A

Noninterference Model