Security Plus - Chapter 6 Flashcards by Paul Silk

Software development Lifecycle (SDLC)

The steps in a model for software development by mapping software creation from an idea to requirements gathering and analysis to design, coding, testing, and rollout. Once in production, it includes user training, maintenance and decommissioning at the end of life.

How well did you know this?

Not at all

Perfectly

SDLC Phases

Planning
Requirements definition
Design
Coding - Includes Unit testing
Testing - Includes User Acceptance testing
Training and Transition
Operations and Maintenance
Decommissioning

How well did you know this?

Not at all

Perfectly

SDLC Planning Phase

Initial investigations into whether the effort should occur are conducted.

How well did you know this?

Not at all

Perfectly

SDLC Requirements Definition Phase

The development team will begin discussions with customers to determine what the desired functionality is, what the current application or system does and doesn’t do, and what improvements are desired.

How well did you know this?

Not at all

Perfectly

SDLC Design Phase

Determining the design for functionality, architecture, integration points and techniques, dataflows, business processes, and other elements that have design implications.

How well did you know this?

Not at all

Perfectly

SDLC Testing Phasae

Testing of the systems or applications by internal users, customers and other stakeholders. This phase also includes User Acceptance testing to ensure that the users of the software are satisfied with it’s functionality.

How well did you know this?

Not at all

Perfectly

SDLC Coding Phase

Perform the actions of coding for the application or system. This could include unit testing which involves testing small sections of the code to ensure it is written properly.

How well did you know this?

Not at all

Perfectly

SDLC Training and Transition Phase

Ensuring that end users are trained on the software and the software has entered general use. Includes patching, updating, minor modifications, and other daily support work.

How well did you know this?

Not at all

Perfectly

SDLC Decommissioning

When a system or application reaches the end of its life by obsolescence or a new version of the software is built to replace this version.

How well did you know this?

Not at all

Perfectly

Network Environments

Development
Testing
Staging
Production

How well did you know this?

Not at all

Perfectly

Development Environment

Used for development or builders to perform coding and workflow development to limit access to production

How well did you know this?

Not at all

Perfectly

Testing Environment

Where software and systems are tested can be tested without impacting the Production environment.

How well did you know this?

Not at all

Perfectly

Staging Environment

A transition environment of code that has successfully cleared testing to be deployed into production.

How well did you know this?

Not at all

Perfectly

Production Environment

This environment hosts all of the software, patches, and other changes to code that has been approved for use by the clients.

How well did you know this?

Not at all

Perfectly

DevOps

Combines the software development and IT operations with the goal of optimizing the SDLC.

How well did you know this?

Not at all

Perfectly

Toolchains

Utilizes processes and applications that assist with coding, building, testing, packaging, releasing, configuring, and monitoring software within DevOps.

How well did you know this?

Not at all

Perfectly

DevSecOps

Utilizes processes and applications that assist with coding, building, testing, packaging, releasing, configuring, monitoring, threat analysis, communication, providing feedback, and ongoing improvement to software and processes.

How well did you know this?

Not at all

Perfectly

Continuous Integration

A development practice that consistently (and on an ongoing basis) checks code into a shared repository to enable the use of automation and scripting to implement automated courses of action that result in continuous delivery of code.

How well did you know this?

Not at all

Perfectly

Continuous Deployment

Rolls out tested changes into production automatically as soon as they have been tested.

How well did you know this?

Not at all

Perfectly

Continuous Validation

Automated security testing of the code that ensures the code is continually functioning appropriately and no new vulnerabilities are discovered.

How well did you know this?

Not at all

Perfectly

Open Worldwide Application Security Project (OWASP)

A broad community of developers and security practitioners which hosts many community developed standards, guides, and best practice documents as well as a multitude of open-source tools.

How well did you know this?

Not at all

Perfectly

OWASP Secure Coding Practices

Define Security Requirements - Implement security throughout the development process.
Leverage Security Framework - Pre-existing security capabilities can make securing applications easier.
Secure Database Access - Prebuild SQL queries to prevent injection and configure database for secure access.
Encode and Escape Data - Remove special characters.
Validate All Inputs - Treat user input as untrusted and filter appropriately.
Implement Digital Identity - Use multi-factor authentication, secure password storage, and session handling.
Enforce Access Controls - Require all requests to go through access control checks, deny by default, and apply the principle of least privilege.
Protect Data Everywhere - Use encryption in transit, and at rest.
Implement Security Logging and Monitoring - This helps detect problems and allows investigation after the fact.
Handle All Errors and Exceptions - Errors should not provide sensitive data, and applications should be tested to ensure that they handle problems gracefully.

How well did you know this?

Not at all

Perfectly

Application Program Interfaces (API)

Interfaces between clients and servers or applications and operating systems that define how the client should ask for information from the server and how the server will respond.

How well did you know this?

Not at all

Perfectly

Code Analysis and Testing

It is important to analyze code to understand what the code is doing, how it performs that task, and where flaws may occur in the program. This is performed through static or dynamic code analysis and with testing methods like fuzzing. Once code is deployed, regression testing is performed to ensure the fixes put in place didn’t create new security issues.

How well did you know this?

Not at all

Perfectly

Static Code Analysis

Known environment testing reviews the code to understand how the program is written and what the code is intended to do.

How well did you know this?

Not at all

Perfectly

Dynamic Code Analysis

Reviews the code through the execution of the code while providing it with input to test the software.

How well did you know this?

Not at all

Perfectly

Fuzzing

Involves sending invalid or random data to an application to test its ability to handle unexpected data. The application is monitored to determine if it crashes, fails, or responds in an incorrect manner. Focuses on identifying simple problems with the application.

How well did you know this?

Not at all

Perfectly

Injection Vulnerabilities

Among the primary mechanisms that attackers use to break through a web application and gain access to systems supporting that application.

How well did you know this?

Not at all

Perfectly

SQL Injection

Web applications often receive input from users and use it to compose a database query that provides results that are sent back to a user. The attacker sends an unusual looking request to the web server and monitors the results of the request.

How well did you know this?

Not at all

Perfectly

Blind Content Based SQL Injection

The attacker sends input to the web application that tests whether the application is interpreting injected code, before attempting an attack.

How well did you know this?

Not at all

Perfectly

Blind Timing Based SQL Injection

When an attacker uses the amount of time it requires to process a query as a channel for retrieving information from a database. Longer delays in returning information usually means there is a possible attack vector available to exploit.

How well did you know this?

Not at all

Perfectly

Code Injection Attacks

These attacks seek to insert attacker-written code into the legitimate code created by a web application developer. These attacks can be seen through other developer-based code in:
LDAP - Lightweight Directory Access Protocol attack
XML - Extensible Markup Language attack
DLL - Dynamic Linked Library attack
HTML - Cross Site Scripting attack (XSS)

How well did you know this?

Not at all

Perfectly

Command Injection Attacks

This occurs when an attacker application code that reaches back to the operating system. This provides the attacker the ability to gain the ability to directly manipulate the operating system.

Password Authentication Attack

Utilizing a user’s password to access a system without proper permission.
- Conducting social engineering attacks that trick the user into revealing their password, either directly or through a false authentication mechanism
- Eavesdropping on encrypted network traffic
- Obtaining a dump of passwords from previously compromised sites and attempting to utilize that list to attempt access hoping that users have not updated their passwords from the one previously used.
- Conduct a brute-force attack in which they obtain a set of weakly hashed passwords from a target system and then conduct a search to crack those passwords and obtain access.
- Attempt to access a system using generally known user names and passwords that may not have been updated from those default settings.

Session Hijacking attacks

An authentication attack that steals an existing authenticated session. If a user authenticated to a website and never successfully logged out or the browser retains the authentication cookie and does not require reauthentication, an attacker may be able to take over the access that was already provided in the previous session.

Cookie Stealing and Manipulation

The taking of a user’s cookie from a web session which an attacker then uses to impersonate the user.
- Eavesdropping on an unencrypted network connection and stealing a copy of the cookie as it is transmitted between the user and the website.
- Installing malware on the user’s browser that retrieves cookies and transmits them back to the attacker
- Engaging in an on-path attack, where an attacker fools the user into thinking they are accessing the legitimate website, when it is a fake authentication site created by the attacker. The attacker then obtains the cookie once the user attempts to login to the fake site.

Session Replay Attack

Once an attacker has a cookie, they can manipulate the cookie and alter the details sent back to the website or use the cookie as the badge required to gain access to the site.

Secure Cookies

Web developers can protect cookies from theft by marking them with the SECURE attribute. These are then never transmitted over an unencrypted HTTP connections.

NTLM Pass -The-Hash Attack

A replay attack that takes place against the operating system. The attacker gains access to a Windows system and then harvests stored NTLM password hashes from the system. This will allow attempts to use the hashes to gain user or admin access to that system or other systems in the same Active Directory domain.

Unvalidated Redirects

An attacker may use an insecure redirect web site as an attack vector, by placing their website as the next step in the process that the user will be directed to enter their credentials. Validated redirects are the way to avoid allowing attackers to access these redirects.

Insecure Direct Object References

When an application is designed to directly retrieve information from a database on an argument provided by the user in either a query string or a POST request and the application does not perform authorization checks. This allows a user to exceed their authority to view information.

Directory Traversal Attack

When web servers allow the inclusion of operators that navigate directory paths and file system access controls don’t properly restrict the access to files stored elsewhere on the server.

File Inclusion Attack

Retrieves files from the local server and executes the code contained within a file, allowing an attacker to fool the web server into executing arbitrary code.
- Local File Inclusion - Seeks to execute code stored somewhere else on the web server.
- Remote File Inclusion - Allows the attacker to execute code that is stored on a remote server.

Web Shell

Allow the attacker to execute commands on the server and view the results in the browser. They allow the attacker to access to the server over http & https ports making the traffic less vulnerable to detection by security tools.

Privilege Escalation

Seeks to increase the level of access that an attacker has to a target system. These attacks exploit vulnerabilities that allow the attacker to transform their account from a standard user to a Root or Administrator user account.

Cross Site Scripting Attack

Occur when web applications allow an attacker to perform HTML injection inserting their own HTML code into a web page.

Reflected Cross Site Scripting Attack

Requesting additional information from a user which causes the user to enter more information than necessary like a username and password, which could then be transmitted to a malicious web link.

Stored Cross Site Scripting Attack

Utilizing code stored on a remote web server and executing that code on the target server.

Request Forgery Attack

Attacks that exploit trust relationships and attempt to have users unwittingly execute commands against a remote server.
- Cross-site request forgery - Exploit the trust that remote sites have in a user’s system to execute commands on the user’s behalf.
- Server-side request forgery - Attack that exploits a server into visiting a URL based on a user-supplied input.

Input Validation

An application security control to verify the data input into a field on a website is the correct type of data. This validation should be performed on the server-side.

Allow List

This is an input validation where the developer describes the exact type of input that is expected from a user and then verifies that input matches the specification before passing the input to other processes or systems.

Deny Listing

Developers describe types of malicious data that are not permitted to be entered as input and are blocked.

Parameter Pollution

An input validation attack that sends a web application more than one value for the same input variable.

Web Application Firewalls (WAF)

Firewalls that work at the application layer, in front of a web server, and receives all network traffic headed to that server. It reviews and analyzes the input headed to the application, performing input validation before passing the input to the web server.

Parameterized Queries

A protection against injection attacks where the client does not directly send SQL code to the database. The client sends arguments to the server which inserts those arguments into a precompiled query template.
- Stored procedures

Sandboxing

The practice of running an application in a controlled or isolated environment to prevent it from interacting negatively with other system resources or applications.

Code Signing

Provides developers with a way to confirm the authenticity of their code to end users. This utilizes a cryptographic function to digitally sign their code with their own private key and the browser uses the developers public key to verify the signature and ensure the code is legitimate and not modified by unauthorized individuals.

Code Reuse

The practice of utilizing known approved code for additional purposes within an organizations development teams.

Software Diversity

Ensuring that areas of the organization’s developers are not reliant on a single piece of code, binary executable file, or compiler. No single point of failure.

Code Repositories

Centralized locations for the storage and management of application source code. To store the source files used in software development in a centralized location that allows for secure storage and coordination of changes among multiple developers.

Integrity Measurement

Uses cryptographic hash functions to verify the code being released into production matches the code that was previously approved.

Application Resilience

Ensuring the application design will be able to be modified by the development team in the face of changing demand.
- Scalability - The application should be designed so that computing resources they require may be incrementally adjusted to support increasing demand.
- Elasticity - Applications should be able to provision resources automatically to scale when necessary and then automatically deprovision those resources to reduce capacity when it is no longer needed.

Source Code Comments

Comments placed throughout code that provides documentation of design choices, explains workflow, and offers details crucial to other developers who may be called on to modify or troubleshoot the code.

Error Handling

Developers write code that is resilient to unexpected situations that an attacker might create in order to test the boundaries of the code.
They must anticipate unexpected situations and steps or create limitations that can handle these situations securely.

Backdoor Vulnerability

Hard-coded maintenance or administrator credentials embedded in the source code.

Package Monitoring

Keeping track of third-party libraries and packages used in your organization, understanding what they do, and being aware of any potential vulnerabilities they have. Developers must maintain the most up-to-date and secure versions of these packages.

Resource Exhaustion

Systems may consume too much memory, storage, processing time, or other resources available to them, rendering the system unstable, disabled, or crippled for other uses.
- Memory Leaks - If the application requests memory from the operating system, it should return the memory to the OS when no longer needed, but the application fails to return all of the memory back to the OS, over a period of time, it can slowly consume all of the memory causing it to crash.

Memory Pointers

An area of memory that stores an address of another location of memory. An issue that may be caused is if the pointer points to an empty file location, an error will be returned. Null Pointer, this may allow an attacker to bypass security controls.

Buffer Overflows

An attack performed by manipulating a program into placing more data into an area of memory than is allocated for the program’s use.

Memory Injection

Maliciously inserting information into memory with instructions that may be executed by a different process running on the system, which is the cause for buffer overflow.

Race Conditions

When the security of a code segment depends upon the sequence of events occurring within the system.

Tine-of-Check (TOC)

A race condition when a system verifies access permissions or other security controls.

Time-of-Use (TOU)

A race condition when the system accesses the resource or uses the permission that was granted.

Target-of-Evaluation (TOE)

A race condition when the particular component, system, or mechanism being evaluated or tested for potential vulnerabilities, such as the system’s method of managing and validating access permissions.

Time-of-Check-to-Time-of-Use (TOCTTOU or TOC/TOU)

A race condition that occurs when a program checks access permissions too far ahead of a resource request.

Unprotected API’s

May lead to unauthorized use of functions by not using appropriate authentication. API’s should be secured using API keys and accessed only over encrypted channels that protect those credentials from eavesdropping attacks.

Security Orchestration, Automation, and Response (SOAR)

A platform that provides opportunities to automate security that cross between multiple systems. Requirements of processes that can be automated are they are repeatable and do not require human interaction.

Use Cases of Automation and Scripting

User provisioning - Automated scripts can handle the process of adding, modifying, or removing user access to systems and networks, reducing manual efforts and human error.
Resource provisioning - Scripts can automate the allocation and deallocation of system resources, ensuring optimal performance and reducing the burden on IT staff.
Guard Rails - Automation can be employed to enforce policy controls and prevent violations of security protocols.
Security Groups - Automated processes can manage security group memberships, ensuring users have appropriate permissions.
Ticket Creation - Automation can streamline the ticketing process, enabling immediate creation and routing of issues to the right teams.
Escalation - For major incidents, scripts can automate the escalation process, alerting key personnel quickly.
Enabling/Disabling services and access - Automation can be used to turn services or access on or off based on certain triggers or conditions.
Continuous Integration Testing - Scripts can automate the build and test process, ensuring faster and more reliable software delivery.
Integrations and APIs - Automated processes can handle data exchange between different software applications through APIs, enhancing interoperability.

Benefits of Automation and Scripting

Achieving efficiency and time savings
Enforcing baselines
Standardizing infrastructure configurations
Scaling in a secure manner
Retaining employees
Reducing reaction time
Serving as a workforce multiplier

Challenges of Automation and Scripting

Complexity
Cost - Upfront costs, which may dissipate over time
Single Point of Failure
Technical Debt - Scripts may become outdated or inefficient
Ongoing Supportability - Maintaining and updating scripts may be difficult

Brainscape's Knowledge GenomeTM

Security Plus - Chapter 6 Flashcards

Brainscape's Knowledge Genome^TM