Software Development Security Flashcards

1
Q

What is a distributed Application ?

A

A distributed application is an application that consists of multiple components residing on multiple separate networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Securing distributed systems ?

A

1) software integrity (managing client versions etc)
2) Data integrity (Data accuracy and sync across sites)
3) Access Control (AAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Role of Agents in Distributed Systems ?

A

1) Patch Management
2) Host Intrusion Detection (HIDS)
3) Performance and Capacity Monitoring

  • specifically an agent is an application in a distributed environment that does a very specific task.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an Applet ?

A
  • A Web based agent, built into the web browser.
  • designed to increase an users web experience
  • ActiveX (not sand boxed, recommend that you block at the firewall or proxy level)
  • Java (Sand Boxed, cannot access memory, hard drive)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an Mashup ?

A
  • A Web page that utilises multiple applications and applets and APIs.
  • Think House pricing / development cost.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is an Object Orientated (OO) Environment ?

A
  • Software is written as an object.

* Objects can be used and re-used in other code. READ: Efficient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

OO Instances ?

A
  • An OO Object is called an instance.

* Started an Object is called instantiation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

OO Behaviour ?

A

The result of an object receiving an action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an OO Class ?

A

A template that defines the methods and variables to be included in a particular type of object.

The class itself contains the common methods and variables, and objects in the class contain only those characteristics that make them unique.

An Example of Class is “Cake” (Nom Nom Nom)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Class Hierarchy ?

A

The tree structure around a class and its object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is OO Delegation ?

A

What happens when an object receives a message requesting a method that it doesn’t have. The object delegates the message to the object that does contain the requested method.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an OO Method ?

A

The procedure (code) contained in an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an OO Message ?

A

How objects communicate with one another. A message contains the name of an object to which it wants to communicate, the method it should perform, and usually one or more parameters. The object sending the message is the sender; the object receiving it is the receiver.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is OO Encapsulation ?

A

The packaging of an object. Everything inside the object is hidden, or encapsulated. Inheritance: An object that gets some of its characteristics from a class. An object inherits characteristics from the class when it’s instantiated. (It doesn’t have to wait for the class to grow old and die.) Instance: A particular object that’s a member of a class.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is OO Multiple Inheritance ?

A

When an object or class inherits characteristics from 1 or more other classes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an OO Object ?

A

The basic building blocks / Unit of OO.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is polyinstantiation? (OO)

A

The process of developing 1 object from another object with different values than the original object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is polymorphism ? (OO)

A

The ability to hide implementation details behind a common message interface.

This permits new objects to be added to a system without having to rewrite existing procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a Database ?

A

A database is a mechanism used to define, store, and manipulate data.
It has a programming and command interface used to create, manage, and administer data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is DBMS ?

A

A Database Management System.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Three most common types of Databases ?

A
  • Hierarchical
  • Relational
  • Object Orientated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Database Aggregation ?

A

When you collect low sensitivity data from several source databases and combine them together to make a high sensitivity data collection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is inference ?

A

This concept refers to the ability of someone to deduce or infer something about sensitive information that’s beyond normal reach because of its sensitivity level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a Data Dictionary ?

A

A database that contains the row and column information of other databases.

A database index if you like.

It can be used to create or re-create tables, to manage security access, and as a control point for managing the schema of the application’s database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a Data Warehouse ?

A

A special-purpose database that’s used for business research, decision support, and planning; comparatively, typical databases support daily business operations.

Used in decision support / data mining. You don’t mine ‘what if’ scenarios on the production Database. You do it on a what if Database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a Hierarchical Database ?

A

Data in a hierarchical database is arranged in a tree structure, with parent records at the top of the database, and a hierarchy of child records in successive layers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a Network Database ?

A

Network databases represent an improvement in the design of hierarchical databases.

In the hierarchical model, relationships between records are defined by the database’s tree structure. In a network database, records can be networked to other records through paths that are different from the hierarchy itself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a Relational Database ?

A

Relational databases are the culmination of database design. A relational database has relationships between data sets

Records are often called rows, and rows are stored in tables. A table can have a primary key, which is one of the fields in the table that contains a unique value. A primary key permits rapid table lookups (queries to find specific records) through binary searches and other data lookup algorithms. An index can also be built for any of the other fields in a table, to facilitate more rapid lookups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a Schema ?

A

A schema is what defines the structure of a relational database, defines table sizes and rows within etc etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a Primary Key ?

A

A table can have a primary key, which is one of the fields in the table that contains a unique value. A primary key permits rapid table lookups (queries to find specific records) through binary searches and other data lookup algorithms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a stored procedure ?

A

Stored procedures are subroutines that can be accessed by software applications. As their name suggests, stored procedures are actually stored in the relational database.

  • Helps make a database resilient to SQL Injection Attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is a prepared Statement ?

A

Prepared statements (sometimes called parameterized statements) are basically canned statements that can be called by the application.

  • Helps make a database resilient to SQL Injection Attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is a Distributed Database ?

A
  • A database whose components exist in multiple physical locations.
  • Named because of its location, not because of its design.
  • Can be hierarchical, network, relational, object, or any other design.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is an Object Database ?

A

The objects in an object database include data records, as well as their methods (application code).

Like OO application programming languages, object databases can have classes (data types), instantiations (individual data records), inheritance, and encapsulation.

Object databases are a niche player in the market for database management systems, where relational databases dominate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a Database Transaction ?

A

A transaction is an action that is performed on a database that results in the addition, alteration, or removal of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is SQL ?

A

The dominant computer language used to manipulate data in a database is Structured Query Language (SQL).

Principal Commands: Select, Update, Insert.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is an SQL Transaction?

A

SQL statements can also be grouped together in a transaction, to ensure that all of the statements are executed together, thus guaranteeing the integrity of the database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is Database Locking ?

A

Databases employ a mechanism known as locking in order to avoid collisions in which two or more programs may be trying to update the same table or row at the same time. A lock can be placed on a field, an entire row, or an entire table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is an Expert System ?

A

A Knowledge Based System (aka: AI)

Expert systems build a database of past events in order to predict outcomes in future situations. An inference engine analyzes the past events to see whether it can find a match between a past event and the current problem.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is Fuzzy Logic ?

A
  • Used by Expert Systems
  • It breaks down the factors influencing a decision or outcome into its components, evaluates each individual component, and then recombines the individual evaluations in order to arrive at the yes/ no or true/ false conclusion for the big question or problem.
  • It produces a quantitative result based on uncertainties.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are certainty factors ?

A
  • Used by Expert Systems:
  • Operate on the numeric probability of yes/ no, true/ false, rain/ snow, or whatever the expert system is working on. The individual probabilities are aggregated, and the final conclusion is reached.
    Example: Tomorrow it will snow in Buffalo.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is a Neural Network ?

A
  • A knowledge Based System (aka: AI)
  • Mimic the biological function of the brain.
  • A neural network accumulates knowledge by observing events; it measures their inputs and outcome. Over time, the neural network becomes proficient at correctly predicting an outcome because it has observed several repetitions of the circumstances and is also told the outcome each time. Then, when confronted with a fresh set of inputs for a new situation, the neural network predicts outcomes with increasing reliability over time.
  • Neural networks learn that input components are weighted, which is to say that their specific degree of influence on the outcome is calculated.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is an Operating System ?

A

Operating system (OS) software is a set of programs that manage computer hardware resources and facilitate the use of application programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the Kernel ?

A
  • The central component of an operating system

* This is the core software in an operating system that performs system functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is Process Management ? (OS)

A
  • Performed by the Kernel
  • It is how the kernel deals with multiple applications running at the same time.
  • The kernel controls the initiation, execution, and termination of programs, as well as the allocation of hardware components (such as CPUs, memory, and peripherals) between the running programs.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is memory management ? (OS)

A
  • Performed by the Kernel
  • The kernel allocates memory to itself as well as to processes that are running. The kernel responds to processes that request more (or less) memory. Programs are permitted to use only the memory allocated to them; the kernel enforces this restriction.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is an Interupt ? (OS)

A
  • Performed by the Kernel.
  • An interrupt is a signal sent to the kernel that directs the kernel to temporarily suspend processing in order to take care of something else. Typically an interrupt comes from one of the computer’s hardware components when some event requires attention from the operating system.
48
Q

What Hardware Resource Management ? (OS)

A
  • Performed by the OS Kernel.
  • The kernel manages each process’s access to the computer’s hardware, including memory, hard disks, network adaptors, and bus adaptors (such as USB and FireWire).
49
Q

What are Device Drivers ? (OS)

A

Another important part of the OS is its device drivers. These are programs used to permit interaction between the kernel and specific hardware devices that are connected to the computer.

50
Q

What is the User Interface ? (OS)

A
  • This is the part of the OS that we use to communicate with the computer.
  • The two primary types of user interfaces are Command line and Graphical.
  • The command line is simple interface controlled by a keyboard.
  • Graphical. This interface divides the screen into “windows” or “panes,” typically controlled by a pointing device (such as a mouse or touchpad) and perhaps also a keyboard.
51
Q

What is Process Isolation ? (OS)

A

The OS restricts processes by forbidding any process from accessing or modifying memory allocated to any other process. This prevents any process from tampering with other processes.

52
Q

What is Network Communication ? (OS)

A

The OS includes basic network protocols to facilitate communication to other computers.

53
Q

What is FileSystem Access ? (OS)

A

The OS restricts access to files and directories in file systems, basing access on permission labels affixed to each file and directory. Only authorized processes may access specific files. This is the mechanism used to restrict users’ access to files on workstations and servers.

54
Q

What is Authentication ? (OS)

A

Before any local or remote user may access any programs or data, the OS needs to know who is performing the access request. The OS requires that the user identify him or herself, typically by entering a userid and password.

55
Q

What is Access Control ? (OS)

A

Most OSs control which users are permitted to access resources on the system,

56
Q

What is SDLC ?

A
  • The systems development life cycle (SDLC, often called the software development life cycle) refers to all the steps required to develop a system from conception through implementation, support, and (ultimately) retirement.
  • In other words from beginning till end.
57
Q

What is the Waterfall model ? (SDLC)

A

The waterfall model is so-called because its steps progress like a series of waterfalls.

In a software development project performed using the waterfall model, each of the stages is performed sequentially, one at a time.

58
Q

What is Conceptual Definition ?

A
  • SDLC
  • Waterfall
  • A high level description of the system
59
Q

What are functional requirements ?

A
  • SDLC
  • Waterfall
  • Functional requirements are basically a list of required characteristics of the system.
60
Q

What are functional specifications ?

A
  • SDLC
  • Waterfall
  • You could call the functional specifications the Engineering department’s version of functional requirements. Rather than a list of have-to-have and nice-to-have items, the functional specification is more of a what-it-is (we hope) or a what-we-think-we-can-build statement.
61
Q

What is Design ?

A
  • SDLC
  • Waterfall
  • Design is the process of developing highest-detail designs. In the application software world, design includes entity-relationship diagrams, data-flow diagrams, database schemas, over-the-wire protocols, and more.
62
Q

What is the Design Review ?

A
  • SDLC
  • Waterfall
  • The design review is the last step in the design process, in which a group of experts (some of whom are on the design team and some of whom aren’t) examine the detailed designs.
63
Q

What is Coding ?

A
  • SDLC
  • Waterfall
  • Coding usually includes unit testing, which is the process of verifying all the modules that are built in this phase.
64
Q

What is OWASP ?

A
  • The Open Web Applications Security Project

* Security practices and designs for building a more secure mouse trap.

65
Q

What is the Code Review ?

A
  • SDLC
  • Waterfall
  • the coding phase ends with a code review
  • more bugs are found (hopefully)
  • software vulns discovered.
66
Q

What is a Unit Test ?

A
  • When portions of an application have been developed, it’s often possible to test the pieces separately. This is called unit testing.
  • Unit testing allows a developer or tester to verify the correct functioning of individual modules in an application. Unit testing is usually done during the coding stage.
67
Q

What is a System Test ?

A
  • A system test occurs when all the components of the entire system have been assembled, and the entire system is tested from end to end.
  • The test plan that was developed back in the functional requirements step (see the section “Functional requirements,” earlier in this chapter) is carried out here.
68
Q

OWASP Security Standards

A
top ten software risks cited by OWASP are: 
* Injection Cross-site scripting (XSS) 
Broken authentication and session management Insecure direct object reference 
Cross-site request forgery (CSRF) 
Security misconfiguration 
Insecure cryptographic storage 
Failure to restrict URL access 
Insufficient transport layer protection 
Invalidated redirects and forwards
69
Q

What is Certification and Accreditation ?

A
  • Certification is the formal evaluation of the system. The system is declared fully functional.
  • Every intended feature performs as planned.
  • Accreditation means the final code / application / product is okay to be put into production.
70
Q

What is Change Management ?

A
  • Change Management is the formal business process that ensures all changes made to a system receive formal review and approval from all stakeholders before implementation.
  • Change Management gives everyone a chance to voice their opinions and concerns about any proposed change so that the change goes as smoothly as possible, with no surprises or interruptions in service.
71
Q

What is a Change Review Board ?

A

A Change Review Board — which has members from departments such as Development, Operations, Customer Support, and Security as well as other stakeholders in the organization — usually performs Change Management.

72
Q

What is Configuration Management ?

A

Configuration Management captures actual changes to software code, end-user documentation, operations documentation, disaster recovery planning documentation, and anything else that’s affected by the change.

Configuration Management archives technical details for each change and release of the system, as well as for each instance of the system, if more than one instance exists. Change Management and Configuration Management address two different aspects of change in a system’s maintenance mode.

Change Management is the what, and Configuration Management is the how.

73
Q

What are the Security principals in software development ?

A
  • Security in the requirements
  • Security in the Design
  • Security in the Testing
  • Security in the implementation
74
Q

What is Process Isolation ?

A
  • With process isolation, running processes aren’t allowed to view or modify memory and cache that’s assigned to another process.
  • A service provided by the Operating System
75
Q

What is Hardware Segmentation ?

A
  • Hardware segmentation refers to the practice of isolating functions to separate hardware platforms as required to ensure the integrity and security of system functions.
  • Segregation of Duties
  • least privilege
76
Q

What is Separation of Privilege ?

A

Also known as least privilege, separation of privilege assures that no individuals or objects (such as programs that make requests of databases) have excessive functions on a system.

77
Q

What is Accountability ? (Security Architecture)

A

Accountability refers to an application’s ability to record every auditable event by describing the event: who made the change, what the change was, and when the change was made.

78
Q

What is Defense in Depth ?

A
  • Also known as layering, defense in depth is a security architecture concept wherein multiple separate mechanisms form protective layers around assets that require protection.
  • For example, a company may have a firewall, but additionally implement host-based access control and other mechanisms. Then, if any one of these protections fails, the others still presumably run and prevent or detect security problems in the environment.
79
Q

What is Abstraction?

A

Abstraction is a process of viewing an application from its highest-level functions, which makes all lower-level functions into abstractions.

Lower-level functions are treated as black boxes — known to work, even if we don’t know how.

80
Q

What is Data Hiding ?

A

Data hiding Data hiding is an object-orientation term that refers to the practice of encapsulating an object within another in order to hide the first object’s functioning details.

81
Q

What is Systems Hide Mode ?

A

System high mode refers to a system that operates at the highest level of information classification. Any user who wants to access such a system must have clearance at or above the information classification level.

82
Q

What is the Security Kernel ?

A
  • The security kernel is composed of hardware, software, and firmware components that mediate access and functions between subjects and objects.
  • The security kernel is a part of the protection rings model in which the operating system kernel occupies the innermost ring, and rings farther away from the innermost ring represent fewer access rights.

& The security kernel is the innermost ring and has full access to all system hardware and data. User programs occupy outer rings and have fewer access privileges.

83
Q

What is the Reference Monitor ?

A

The reference monitor is a component implemented by the security kernel that enforces access controls on data and devices on a system.

In other words, when a user tries to access a file, the reference monitor ultimately performs the Is This Person Allowed to Access This File? function.

84
Q

Supervisor vs User Modes ?

A

Modern operating systems use the concept of privilege associated with user accounts.

For instance, UNIX has the root account, and Windows Server has the Domain Administrator and Local Administrator roles.

Only system or network administrators can use these accounts, with which they perform operating system and utility management functions.

85
Q

What is an SLA ?

A

The Service-Level Agreement (SLA) is a quasi-legal document (it’s a real legal document when the application service provider is a different company than the organization that uses the application) that pledges the application performs to a set of minimum standards.

86
Q

SLA Features:

A
  • Hours of availability
  • Average and peak number of concurrent users:
  • Transaction throughput
  • Data storage capacity
  • Application response times
  • Service desk response times
  • Security incident response times
  • Escalation process during times of failure
87
Q

What is a Computer Worm ?

A

Worms propagate by attacking known weaknesses on computer systems. On those systems where the worm finds a weakness, it can successfully break in and enter. Whatever the weakness happens to be, the result is the same: The worm can assume enough control of the system (or just of the application whose weakness it exploited) to use it as a base to launch attacks against more systems.

EX: Nimda, CodeRed, Conficker.

88
Q

What is a Computer Virus ?

A
  • The main purpose of a computer virus, a (usually) small program, is to replicate itself.

Early computer viruses attached themselves to floppy disks’ boot sectors or to executables (such as .com or .exe files).

  • Viruses attached to executable files would spread when a user ran those executable files. Multi-partition viruses spread by using both the boot sector and executable files.

Today, viruses spread in many other ways, including macros found in documents, as well as in image files, JavaScript and ActiveX controls. We’ve also seen viruses spread through cross-site scripting vulnerabilities in websites and through instant messaging software.

89
Q

What is a Root Kit ?

A

A rootkit is a malicious program that’s designed to hide itself on the target system in order to evade detection.

*The purpose of a rootkit varies according to its maker. A rootkit may perform any of the actions that most other types of malware are capable of, including destroying, altering, or stealing data; intercepting or altering data transmissions; or changing the behavior of the target system.

90
Q

What is a Trojan Horse ?

A

A Trojan horse, is an object that claims to be one thing but turns out to be something far different.

Trojan horses generally don’t spread by replicating themselves, but they can be very damaging nonetheless. A typical Trojan horse arrives in the payload of an e-mail message, usually an attached executable file or a file with macros.

91
Q

What is a Logic Bomb ?

A
  • A logic bomb is a program designed to cause damage when some computer/ network event has occurred.
  • For instance, a logic bomb could destroy files when a user invokes a certain program, such as a text editor.
  • Logic bombs don’t replicate themselves, but viruses or worms can leave them behind.
92
Q

What are Malicious Applets ?

A

ActiveX and Java applets can carry malicious code and wreak havoc on users’ computers. Strictly speaking, attackers can write destructive ActiveX applets more easily than Java applets because the applets have unfettered access to the entire computer.

Destructive Java applets are far more difficult to write because they must exploit some weakness in the Java sandbox in order to break out of it and do whatever damaging deed it was designed to do.

93
Q

What is a Trap Door ?

A

A trap door is a type of logic bomb that functions as part of a program. The trap door performs an undocumented function when certain conditions are met. Often these functions are designed to bypass security and other control mechanisms.

94
Q

What is Hidden Code ?

A

Hidden code is a set of computer instructions hiding inside another program that carries out some usually-malicious act. An example of hidden code would be an application’s reporting program that also happens to erase certain entries from the audit trail.

95
Q

What is an Injection Attack ?

A

An injection attack is one where the attacker is attempting to insert computer instructions into a computer program’s input field, in an attempt to trick the target computer into performing functions unintended by the program’s designer.

Example: SQL Injection: Here, the attacker is injecting SQL statements in an attempt to trick the back-end database server to perform specific functions.

Example: Frame Injection (also known as cross-frame scripting, or XFS): Here, the attacker is attempting to load arbitrary code into a browser in order to steal data from other frames present in the browser session.

96
Q

What is a Cross Site Scripting Attack ?

A

A cross-site scripting attack, (XSS), is one where an attacker is able to inject client-side script into web pages viewed by other intended victims.

This attack allows an attacker to bypass security mechanisms present in websites and web browsers. The two principal types of XSS attacks are non-persistent and persistent attacks.

In a typical non-persistent attack, the attacker must trick the victim into clicking a malicious URL that contains malicious script, which will be executed on the victim’s browser. Such a script could, for instance, steal the victim’s session cookies — which could then be used by the attacker to access the victim’s session.

In a persistent attack, the attacker arranges to store malicious code on a website (such as a message board, or comments in a blog). Then any users who click the malicious link will be executing malicious script on their
systems.

97
Q

What is Cross Site Web Forgery ?

A

In a cross-site request forgery (CSRF) attack, the attacker is attempting to trick a victim into clicking a link that will perform some action that the victim would not otherwise approve.

A common method used to protect users from CSRF attacks is the inclusion of one-time-use hidden variables (known as a “nonce”) on important pages.

The website keeps track of these hidden variables; any variation (or repeat) will indicate possible tampering.

Another method used to protect users against CSRF attacks is the inclusion of a secondary approval dialogue for any significant transaction. That way, if the attacker is able to sneak in a CSRF link that the victim clicks, the attack won’t be successful unless the victim also approves the transaction.

98
Q

What is Escalation of Privilege ?

A

One technique commonly used by attackers is known as escalation of privilege. Here an attacker accesses a system, and then uses any number of attack techniques (such as an injection attack) to increase the attacker’s privilege level from (say) that of an ordinary user to that of an administrator.

99
Q

What is Denial of Service ?

A

The Denial of Service (DoS) attack is an interesting one because the attacker never does gain entry into the targeted computer system — then again, he or she isn’t trying to get in. Instead, the attacker is trying to make the target system unavailable for its users.

The ping of death attack (where a malformed or extremely large “ping” packet is sent to the target system) is a good example of a DoS attack.

A form of DoS attack, called Distributed Denial of Service (DDoS), occurs when an attacker uses hundreds, or even thousands or tens of thousands, of systems to attack a target simultaneously.

100
Q

What are Dictionary Attacks ?

A

The dictionary attack is a method used to crack computer account passwords by using common words found in a dictionary.

Most commonly, a dictionary-attack tool acquires a copy of the UNIX password or shadow file, or the Windows SAM file. The hacker then loads the file on his or her local system and runs a password-cracking program to attempt to discover account passwords by guessing dictionary words and combinations of dictionary words and numbers.

101
Q

What is Spoofing ?

A

In a spoofing attack, the attacker changes the network identity of a computer or program some way so as to trick the targeted system into granting access to the attacker.

102
Q

What is Social Engineering ?

A

Social engineering is an attack against people as a way of getting access to targeted systems. The classic case of social engineering occurs when a hacker makes a number of telephone calls to various people in an organization and gets a tidbit of information from each one.

103
Q

What is Phishing ?

A
  • A perpetrator creates genuine-looking e-mail messages that appear to have originated from real, high-value sites, such as online banking.
  • The purpose of the e-mail is to trick the recipient into clicking the hyperlink and stealing the users credentials.
104
Q

What is Pharming ?

A

The end result of pharming is very similar to phishing: A user goes to an imposter website whose owner wants to steal users’ login credentials. The method of attack, however, is quite different. In a pharming attack, the attacker targets the user’s DNS environment so that it returns incorrect values, leading victims to imposter sites.

105
Q

What is Spear Phishing ?

A

Spear phishing: A type of phishing in which the attacker targets certain users or groups of users.

106
Q

What is Whaling ?

A

A type of phishing attack that targets senior executives in one or more organizations.

107
Q

What is Pseudo Flaw ?

A

A pseudo flaw attack is a special form of social engineering in which an attacker, posing as a system or security administrator or vendor, tells unsuspecting users that a security flaw has been discovered on their system and that they should install a certain patch, which is usually a Trojan horse.

108
Q

What is a Maintenance Hook ?

A

When a developer builds hooks into an application that can change the run time mode into a maintenance or management mode (such as the user of a certain user name) this new mode could expose features and functions and leads to vulnerabilities.

109
Q

What is Password Sniffing ?

A

An intruder (or employee) may devise some means for listening to traffic on the organization’s internal network by using a sniffer program. Sniffer programs can listen for and capture login sessions, recording user IDs and passwords.

110
Q

Traffic Analysis and Inference ?

A

An attacker can analyze network traffic patterns and other types of transmissions in order to make inferences about something that he or she wants to know more about.

In this type of attack, the attacker doesn’t have access to the contents of the transmissions — only their patterns.

111
Q

What is Brute Force ?

A

Brute force is the most time-consuming and generally a last resort effort.

Whatever the target, the perpetrator of a brute-force attack repeatedly hits his or her target, making small changes each time, hoping that he or she can eventually get in.

112
Q

AV Software, How does it work ?

A

Antivirus software operates by intercepting operating system routines that store files and open files. The AV software compares the contents of the file being opened or stored against a list of virus signatures. If the AV software detects a virus, it prevents the file from being opened or saved, usually alerting the user via a pop-up window

113
Q

what is Heuristics ?

A

Rather than looking for a specific signature of a specific file a heuristics engine looks for a pattern or anomalous behaviour, such as renaming a .exe file.

Benefits:
Conservation of space
Decreased download time
Improved computer performance

114
Q

What is a Bot Herder ?

A

Bot herders are individuals who establish, grow, and use bot armies to carry out attacks and cause other types of trouble. They may develop their own bot software, but mostly they use bot software developed by others.

115
Q

What is a script Kiddie ?

A

A less knowledgeable attacker that uses a tool developed by someone else to cause damage.

116
Q

What is a Phreaker ?

A

The original phreakers were people who cracked telephone networks in order to get free long-distance service. Improvements in telephone networks have rendered the original techniques useless, and some phreakers have resorted to outright criminal acts, such as stealing long-distance calling cards. The term phreakers is sometimes used to describe hackers who try to break into systems and services