Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > Software Development Security (DEV) > Flashcards

Software Development Security (DEV) Flashcards

1
Q

ACID test

A

set of best practices for programmers to seek in all application or database design: Atomicity, Consistency, Isolation, Durability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Active X

A

Authenticode, relies on digital signatures, annoying dialogs people click away

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Application Programming Interface

A

a library of commands maintained by a system for other programs to use, provides consistency and integrity for the programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Assembler

A

is the tool that converts a high level language into machine language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Assembler - DEV

A

Converts machine-code into binary machine instructions. Translate assembly language into machine language.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Assembly Code

A

low-level programming language with a few simple operations this code is harder to maintain, less readable, and has the potential to be substantially longer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Atomicity

A

indivisible, data field must contain only one value that either all transactions take place or none do

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Backdoor

A

Program installed by an attacker to enable him to come back on a later date without going through the proper authorization channels, maintenance hook for developers sometimes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Behavior

A

Results exhibited by an object in response to a msg

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Big Endian

A

Most significant byte is stored first. SPARC uses this architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Blue Screen of Death

A

When a Windows system experiences a dangerous failure and enters a full secure state (reboot)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Boot sector

A

Moves or overwrites the boot sector with the virus code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

boot sector infector

A

Attacks the MBR - the portion of bootable media that the computer uses to load the operating system during the boot process. MBR viruses store the majority of their code on another portion of the storage media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Botnet

A

organized group of compromised computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Buffer

A

an area of memory allocated with a fixed size. It is commonly used as a temporary holding zone when data is transferred between two devices that are not operating at the same speed or workload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Buffer Overflow

A

Occurs when an area that has been allocated a specific storage space has more data copied to it than it can handle. Two classes include heap and stack overflow.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Byte Code

A

program code that is in between the high level language code understood by humans and machine code read by computers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Candidate Key

A

An attribute that is a unique identifier within a given table, one is chosen to be the primary and the others are alternate. Subset of attributes that can be used to uniquely identify any record in a table. No two records in the same table will ever contain the same values for all attributes. Each table may have one or more, which are chosen from column headings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CASE

A

Tool for development, if concerned about security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Change Management Process

A

a business managers and software engineer’s process to protect the organization from development-related issues. Has three components: Request, Change, and Release Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Checkpoint

A

part of a transaction control for a database which informs the database of the last recorded transaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Class

A

OOP concept of a template that consist of attributes and behaviors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

compiler

A

converts source code to an executable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Cleanroom

A

Write code correctly first time, quality thru design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Closed source

A

Is an opposing coding stance that keeps source code confidential. Can be reverse engineered or decompiled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Closed system

A

Is one that is proprietary with no third-party product support, does not define if it’s code can be viewed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Code Review

A

Peer-driven process that includes multiple developers, may be automated, may review several hundred lines an hour, done after it’s developed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Cohesion

A

Ability to perform without use of other programs, strength of the relationship between the purposes of methods within the same class

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

COM, Common Object Model

A

Support exchange of objects amongst programs. This used to be called OLE. DCOM is the network variant (distributed)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Companion virus

A

infected code is stored not in the host program, but in a separate files. Takes advantage of search order of an OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Compiler

A

converts source code to an executable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Compiler - DEV

A

Translates higher level program into an executable file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Compression

A

Appended to executables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Configuration Audit

A

Periodic, should be conducted to ensure that the actual production environment is consistent with the accounting records and that no unauthorized changes have taken place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Configuration Control

A

Ensures that changes to software versions are made in accordance with policies. Updates can be made only from authorized distributions in accordance with those policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Configuration Identification

A

Administrators document covered software products throughout the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Configuration Management Process

A

Used to control the version( s) of software used throughout an organization and formally track and control changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Consistency

A

property that data is represented in the same manner at all times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

CORBA, Common object request

A

Broker architecture enables programs written in different languages and using different platforms and OS’s through IDL (Interface Definition Language)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Coupling

A

Effect on other modules. Level of interaction between objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Covert channels

A

Is a way to receive information in an unauthorized manner, information flood that is not protected by a security mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Covert Storage Channel

A

Processes communicate via storage space on the system; Writing to storage by one process and reading by another of lower security level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Covert timing channel

A

One process relays to another by modulating its use of system resources. Typing rhythm of Morse Code is an example

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Cross-site scripting

A

malware that uses the trust on a website to redirect users to untrusted websites which captures data or installs more malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

CSRF (XSRF)

A

Cross site request forgery: attacks exploit the trust that sites have in a user’s browser by attempting to force the submission of authenticated request to third-party sites.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Dangling Pointer

A

false memory reference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Data dictionary

A

a description of a database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Data Diddler

A

malware that makes small random changes to many data points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Data Hiding

A

a feature of object oriented programming languages. Classes and variables may be marked private, which restricts outside access to the internal workings of a class.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Data marts

A

small data warehouse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Data Type

A

specifies the way data will be stored in memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Database Contamination

A

z-Mixing data with different classification levels and/ or need-to-know requirements and is a significant security challenge. Often, administrators will deploy a trusted front end to add multilevel security to a legacy or insecure DBMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Database Partitioning

A

Process of splitting a single database into multiple parts, each with a unique and distinct security level or type of content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Data warehouse

A

a copy of transaction data, designed for querying and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Databases

A

a collection of information designed to reduce duplication and increase integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

DB main components

A

Schemas, blueprints; tables, views

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

DBMS

A

Refers to a suite of software programs that maintains and provides controlled access to data components stored in rows and columns of a table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

DCL

A

Data Control Language: subset of SQL used to control access to data in a database, using GRANT and REVOKE statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

DDE

A

Dynamic Data Exchange: enables applications to work in a client/server model by providing the inter-process communications mechanism (IPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

DDL

A

Data Definition Language: defines structure and schema

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Deadlock

A

a condition in which neither party is willing to stop their activity for the other to complete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Delegation

A

Forwarding a request to another object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Denial of Service

A

an availability attack, to consume resources to the point of exhaustion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

DevOps

A

a combination of Development and Operations, symbolizing that these functions must merge and cooperate to meet business requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Directory Traversal Attack

A

Attempt to force the web application to navigate up the file hierarchy and retrieve a file that should not normally be provided to a web user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Dirty Reads

A

When one transaction reads a value from a Db that was written by another transaction that did not commit, Db concurrency issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Disassembler

A

software tool is used to convert compiled programs in machine code to assembly code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Distributed Denial of Service

A

an availability attack, to consume resources to the point of exhaustion from multiple vectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

DML

A

Data Manipulation Language: view, control and use the database via VIEW, ADD, MODIFY, SORT and DELETE commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Durability

A

what is will remain, persistence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Dynamic Lifetime Objects

A

Created on the fly by software in an Object Oriented Programming environment. Preassembled code that is a self-contained module

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Dynamic Link Library

A

a programming component that runs on Win32 systems and contains functionality that is used by many other programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Encapsulation

A

a feature of object-oriented programming, provides a logical structure to a program and allows for easy methods of inheritance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Expert Systems

A

Seek to embody accumulated knowledge on a particular subject and apply it in a consistent fashion to future decisions. Has two main components: the knowledge base and the inference engine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Exploit

A

causes a software vulnerability to be triggered and leveraged by the attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Fifth-Generation Languages (5GL)

A

Allow programmers to create code using visual interfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

First-generation languages (1GL)

A

Include all machine languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Foreign Key

A

Represents a reference to an entry in some other table that is a primary key there. Link between the foreign and primary keys represents the relationship between the tuples. Enforces referential integrity Main Components of a Db using Db - Schemas; blueprints - tables - views

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Fourth-generation languages (4GL)

A

Attempt to approximate natural languages and include SQL, which is used by databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Function

A

a miniature program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Functional Analysis and Planning

A

Define need, requirements, review proposed security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Gantt Chart

A

Bar type; shows the interrelationships over time between projects and schedules. Graphical illustration of a schedule that helps plan, coordinate, and track specific project tasks. WBS a subpart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Hardware segmentation

A

Is similar to process isolation in purpose. Difference is that hardware segmentation enforces these requirements through the use of physical hardware controls rather than the logical process isolation controls imposed by an operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Heap

A

an area of memory utilized by an application and is allocated dynamically at runtime. Static variables are stored on the stack along with data allocated using the malloc interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Heuristic ANTI-Virus

A

Behavioral can detect new malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

High coupling

A

Module largely affects many more modules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

HOAXES

A

False warnings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Hotfix, update, Security fix

A

Single patch, patches provide updates to operating systems and applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

HTTP Response Splitting

A

uncheck data input which results in redirection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Incorrect Summaries

A

When one transaction is using an aggregate function to summarize data stored in a Db while a second transaction is making modifications to a Db, causing incorrect information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Inference

A

to jump to a conclusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Inheritance

A

object-oriented organization and encapsulation allow programmers to easily reuse previously written code. It saves time since programmers do not have to recode previously implemented functionality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Instance

A

OOP concept of an object at runtime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Integer Wrapping

A

in the case of unsigned values, this occurs when an overly large unsigned value is sent to an application that “passes” the integer back to zero or a small number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Interpreter

A

line by line translation from a high level language to machine code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Interpreter - DEV

A

Reads higher level code, one line at the time to produce machine instructions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Isolation

A

another subject cannot see an ongoing or pending update until it is complete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Java

A

modern, object oriented programming language. It combines a similar syntax to C and C++ with features such as platform independence and automatic garbage collection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

JavaScript

A

Interpreted language that does not make use of a complier to transform code into an executable state. Java, C, and C++ are all compiled languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Kernel Mode

A

Used by processor to execute instructions from OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Layering processes

A

Implement a structure similar to the ring model used for operating modes and apply it to each operating system process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Little Endian

A

the least significant byte is stored first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Logic bomb

A

a program that waits for a condition or time to occur that executes an inappropriate activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Logic Bomb/Code Bomb

A

Executes when a certain event happens (like accessing a bank account or employee being fired) or a data/time occurs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

LOKI

A

Tool used for covert channel that writes data directly after the ICMP header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Lost Updates

A

When one transaction writes a value to the Db that overwrites a value needed by transactions that have earlier precedence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

MAC

A

the hardware address of a particular computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Machine language

A

program instructions based upon the CPU’s specific architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Macro Virus

A

Most common in office productivity documents .doc/.docx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Malformed input

A

inappropriate data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Malloc

A

a function call dynamically allocates n number of bytes on the heap. Many vulnerabilities are associated with the way this data is handled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Man-made Threats

A

Bombing, strikes, toxin spills

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

MDM, Mobile device management

A

Software solution to manage the myriad mobile devices that employees use to access company resources. Goals are to improve security, provide monitoring, enable remote management, and support troubleshooting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Memset

A

a function call is used to fill a heap buffer with a specified number of bytes of a certain character

115
Q

Message

A

Communication to object to perform an action

116
Q

Metadata

A

information about data or records

117
Q

Method

A

another name for a function in languages such as Java and C#. It may be thought of as a miniature program.

118
Q

Multilevel Security

A

Essential to keep data with different requirements separate

119
Q

Multipart virus

A

Infects both the boot sector and executable files; becomes resident first in memory and then infects the boot sector and finally the entire system, uses two or more propagation mechanisms

120
Q

Multiple Inheritance

A

Class inherits characteristics from more than one parent class

121
Q

Multistate systems

A

Capable of implementing a much higher level of security. These systems are certified to handle multiple security levels simultaneously by using specialized mechanisms

122
Q

Natural Threats

A

Fires, explosions, water, storms

123
Q

Nessus

A

A popular vulnerability scanner managed by Tenable Network Security, and it combines multiple techniques to detect a wide range of vulnerabilities. It uses port scans to detect open ports and identify the services and protocols that are likely running on these systems. Once Nessus discovers basic details about systems, it can then follow up with queries to test the systems for known vulnerabilities, such as if the system is up-to-date with current patches. Attacker can use to best identify vulnerabilities in a targeted system

124
Q

Neural Networks

A

Use complex computations to replace partial functions of the human mind, Based on function of biologic neurons, Works with weighted inputs

125
Q

Non-resident virus

A

Attached to .exe

126
Q

NULL

A

a term used to describe a programming variable which has not had a value set, this value is not necessarily the same as a value of “” or 0.

127
Q

Object Oriented Programming

A

design philosophy and a type of programming language, which breaks a program into smaller units. Each unit has it’s own function.

128
Q

Object reuse

A

unclear buffers or media

129
Q

Object-oriented

A

programs are organized into classes. Instances of classes contain data and methods which performs actions on that data.

130
Q

ODBC

A

Open Database Connectivity: feature that allows applications to communicate with different types of databases without having to be directly programmed for interaction with each type. ODBC acts as a proxy

131
Q

Off-by-one

A

a bug is present when a buffer is set up with size n and somewhere in the application a function attempts to write n+1 bytes to the buffer. This often occurs with static buffers.

132
Q

OOD, Design

A

Objects are the basic units, and instances of classes

133
Q

OOP, Programming

A

Employment of objects and methods
If class = airplane, objects like fighter plane, cargo plane, passenger plane can be created. Method would be what a plane would do with a message like: climb, dive, and roll

134
Q

Open source

A

Is a coding stance that allows others to view the source code of a program, distributed free or for a fee

135
Q

Open system

A

Is one with published APIs that allow third parties to develop products to interact with it

136
Q

Operations and Maintenance

A

Release into production. Certification/accreditation

137
Q

ORBs, Object Request Brokers

A

Middleware that acts as locators and distributors of the objects across networks

138
Q

Patch Management

A

business and technical process of applying security software updates in a regulated periodic way

139
Q

Patch Management system

A

Prevents outages from known attacks by ensuring systems are patched. Patches aren’t available for new attacks. However, the patch management system doesn’t provide the updates. Ensuring systems are patched reduces vulnerabilities but it does not eliminate them

140
Q

Payload

A

final purpose or result

141
Q

PERT

A

Program Evaluation Review Technique: project-scheduling tool used to judge the size of a software product in development and calculate the standard deviation (SD) for risk assessment. Relates the estimated lowest possible size, the most likely size, and the highest possible size of each component. Used to direct improvements in project management and software coding to produce more efficient software

142
Q

Phlashing

A

Malicious variation of official BIOS or firmware is installed that introduces remote control or other malicious features into a device. UEFI – replacement for BIOS

143
Q

Platform Independence

A

idea that program code can run on different systems without modification or recompilation

144
Q

Polyinstantiation

A

Occurs when two or more rows in the same relational database table appear to have identical primary key elements but contain different data for use at differing classification levels. It is often used as a defense against inference attacks

145
Q

Polymorphic virus

A

This is also a self-garbling where it changes the “garble” pattern each time it spreads. As a result, it is also difficult to detect

146
Q

Polymorphism

A

objects or programming that looks different, but act the same. More accurately: Objects of many different classes that are related by some common super class. When different subclasses may have different methods using the same interfaces that respond differently

147
Q

Primary Key

A

Provide the sole tuple-level addressing mechanism within the relational model. Cannot contain a null value and cannot change or become null during the life of each entity. When the primary key of one relation is used as an attribute in another relation, it is the foreign key in that relation. Uniquely identify a record in a database

148
Q

Printf

A

LIBC function for outputting data to a command-line interface

149
Q

Procedural Language Programs

A

may be viewed as a sequence of instructions, where data at certain memory locations are modified at each step

150
Q

Program

A

collection of commands that are understood by a computer system and may be written in a high-level language, such as Java or C, or in a low-level assembly language

151
Q

Project Initiation

A

Feasibility, cost, risk analysis, Management approval, basic security objectives

152
Q

Protection domain

A

Execution and memory space assigned to each process

153
Q

Protection Rings

A

(MIT’s MULTICS design)
Ring 0 - Operating system kernel. The OS’ core. The kernel manages the HW (for example, processor cycles and memory) and supplies fundamental services that the HW does not provide.
Ring 1 - Remaining parts of the operating system
Ring 2 - I/O drivers and utilities
Ring 3 - Applications and programs
Layers 1 and 2 contain device drivers but are not normally implemented in practice. Layer 3 contains user applications. Layer 4 does not exist

154
Q

Race condition

A

a state where two subjects can access the same object without proper mediation

155
Q

ransomeware

A

Extortion via the internet, typically encrypting victim’s data and files

156
Q

RAT, Remote Access Trojan

A

Remote control programs that have the malicious code and allow for unauthorized remote access Back orifice, sub seven, net bus )

157
Q

Referential Integrity

A

All foreign keys reference existing primary keys

158
Q

Register

A

an area on the processor used to store information. Intel architecture: eax, ebx, ecx, edx, esi, and edi.

159
Q

Release Control

A

Once the changes are finalized, they must be approved through procedure

160
Q

Request Control

A

Provides an organized framework within which users can request modifications, managers can conduct cost/ benefit analysis, and developers can prioritize tasks

161
Q

Resident virus

A

Loads when a program loads in memory

162
Q

Revisions/Disposal

A

Remove. Sanitation and destruction of unneeded data

163
Q

Rollback

A

transaction controls for a database, a return to a previous state

164
Q

Rootkit

A

malware that subverts the detective controls of an operating system

165
Q

Salami

A

malware that makes many small changes over time to a single data point or system

166
Q

Sandbox

A

a construct used to control code execution. Code executed cannot affect outside systems. This is particularly useful for security when a user needs to run mobile code, such as Java applets.

167
Q

Second-generation languages (2GL)

A

Include all assembly languages

168
Q

Self-garbling virus

A

Attempts to hide by garbling its code; as it spreads, it changes the way its code is encoded

169
Q

Semantic Integrity

A

Make sure that rules are enforced on all data types, logical values that could adversely affect the structure of the database

170
Q

Separation of privilege

A

Builds on the principle of least privilege. Requires the use of granular access permissions; that is, different permissions for each type of privileged operation. This allows designers to assign some processes rights to perform certain supervisory functions without granting them unrestricted access to the system

171
Q

Service Pack

A

Collection of unrelated patches released in a large collection

172
Q

Service Provider Interface

A

used by devices to communicate with software. It is normally written by the manufacturer of a hardware device to communicate with the operating system.

173
Q

Shellcode

A

byte code that executes a shell or the code that is executed when an exploit is successful

174
Q

Signature based ANTI-Virus

A

Cannot detect new malware

175
Q

Simplistic Model

A

Assumed each step could be completed and finalized without any effect from the later stages that may require rework

176
Q

Slack space

A

unused storage capacity

177
Q

Software Capability Maturity model (CMM)

A

Quality is a direct function of quality of development and maintenance.
Procedures, principles, and practices that underlie development process maturity. 5 Levels:

  1. initiating – competent people, informal processes, ad-hoc, absence of formal process
  2. repeatable – project management processes, basic life-cycle management processes
  3. defined – engineering processes, presence of basic life-cycle management processes and reuse of code, use of requirements management, software project planning, quality assurance, configuration management practices
  4. managed – product and process improvement, quantitatively controlled
  5. Optimizing – continuous process improvement Works with an IDEAL model
178
Q

Software Development

A

Programmers create code. Unit testing Check modules. Prototyping, Verification, Validation

179
Q

Spiral

A

a design methodology which addresses risks early and often

180
Q

Spiral Model

A

Angular = progress made
Radial = cost
Lower left = development plans
Upper left = objectives of the plans, alternatives checked
Upper right = assessing alternatives, risk analysis
Lower right = final development
Left horizontal axis = includes the major review required to complete each full cycle

181
Q

Spyware

A

program that inappropriately collects private data or activity

182
Q

SQL injection

A

a type of malformed input that takes advantage of an appropriate true conditional logic statement adding a request for data that is against the security policy

183
Q

Stack

A

an area of memory used to hold temporary data. It grows and shrinks throughout the duration of a program’s runtime.

184
Q

Stack Overflow

A

occurs when a buffer has been overrun in the stack space. When this happens, the return address is overwritten, allowing for arbitrary code to be executed.

185
Q

Stealth virus

A

Hides modifications to files or boot records and itself

186
Q

strcpy

A

LIBC function call is more commonly misimplemented because it copies data from one buffer to another without any size limitation.

187
Q

Strong Passwords

A

Social engineering best attack method to beat

188
Q

Structured Query Language

A

Database systems commands used to create, access, and modify data

189
Q

System Design Specifications

A

Develop detailed design specs, Review support documentation, Examine security controls

190
Q

System infector

A

Contaminates BIOS command other system files. It is often a memory resident virus

191
Q

System Life Cycle

A

project management process with following phases: design and development, production, distribution, operation, maintenance, retirement, and disposal

192
Q

Third-generation languages (3GL)

A

include all compiled languages

193
Q

Threat Modeling

A

Reduce the number of security-related design and coding flaws, reduce severity of non-security related files, not to reduce number of threat vectors

194
Q

Time of Check/Time of Use

A

a race condition where the security changes during the object’s access

195
Q

Trapdoors

A

(Backdoors) (maintenance hooks) a programming device used in development to circumvent controls.

196
Q

Trojan horse

A

a program with an inappropriate second purpose

197
Q

Trojans

A

Pretend to do one thing while performing another

198
Q

Tuple

A

Row or record

199
Q

Virtual Machine

A

a software simulation of a platform that can execute code. It allows code to execute without being tailored to the specific hardware processor.

200
Q

Virus

A

independent malware that requires user interaction to execute

201
Q

Vulnerability

A

an exposure that has the potential to be exploited. Most are specific software bugs or logic errors.

202
Q

Waterfall including Validation and Verification (V&V)

A

Waterfall including Validation and Verification (V&V)
Reinterpretation where verification evaluates the product during development against specification and validation refers to the work product satisfying the real-world requirements and concepts.
Verification=doing the job right Validation:= doing the right job

203
Q

Waterfall Model

A

a design methodology which executes in a linear one way fashion

Can be managed if developers are limited going back only one step. If rework may be done at any stage it’s not manageable. Problem: it assumes that a phase or stage ends at a specific time.
System Requirements-> Software Requirements -> Analysis ->
Program Design -> Coding -> Testing -> Operations & Maintenance

204
Q

Worm

A

autonomous malware that requires a flaw in a service

205
Q

x86

A

a family of computer architectures commonly associated with Intel

206
Q

0day

A

meant to describe an exploit that has been released on or before the corresponding vulnerability has been publicly released

207
Q

2-phase commit

A

a distributed system’s transaction control that requires updates to complete or rollback

208
Q

Abstraction

A

a fundamental principle behind object-oriented programming, users of an object only need to know the proper syntax for using an object and the type of data that will be returned as a result

209
Q

Acceptance Testing and Implementation

A

Separation of duties, security testing, data validation, bounds checking, certification, accreditation, part of release control

210
Q

Adware

A

unsolicited advertising software

211
Q

Aggregate

A

Summarize large amounts of data and provide only summary information as a result

212
Q

Agile Software Development

A

Emphasis on customer needs for new functionality that quickly meets those needs in an iterative fashion.
- Individuals and interactions over processes and tools
- Working software over comprehensive documentation
- Customer collaboration over contract negotiation
- Responding to change over following a plan

213
Q

Alternate Data Streams

A

a covert storage channel on the file attribute, also File system forks

214
Q

API Keys

A

a unique identifier and a secret token for authentication, generally have a set of access rights on the API associated with it

215
Q

800-64

A

Initiation
Development/Acquisition
Implementation/Assessment
Operations and Maintenance
Disposal

216
Q

800-64 Initiation

A

I Plan and Set Projects to Complete Information Systems And Assess Engineering

Initiate Project - Security Planning
Categorize Information System
Assess Business Impact
Assess Privacy Impact
Ensure Secure System Development

217
Q

Initiate Project - Security Planning

A

Outputs - Supporting Documents, Common Understanding of Security Expectations, Initial Schedule of Security Activities or Decisions

218
Q

Categorize Information System

A

Outputs - Security Categorization, High-Level Security Requirements, Level of Effort or Rigor Estimates

219
Q

Assess Business Impact

A

Outputs - Linkage to Business Drivers, Core System Components, Initial Recovery Time and Point Objectives

220
Q

Assess Privacy Impact

A

Output - Privacy Impact Assessment

221
Q

Ensure Secure System Development

A

Outputs - Security Training for Development Team, Quality Assurance Plans, Development and Coding Standards

222
Q

800-64 Initiation Phase Control Gates

A

Doctor’s Assistant’S SCissoRs needed for Preparation of Surgery Room which is FAR from Rest Medical Room

Determine Acquisition Strategy
System Concept Review
Performance Specification Review
Financial Approval or Review

223
Q

800-64 Development/Acquisition

A

ARchitect designS
inSpector Documents Silly Codes
interior Designer Selects Artwork
Environment is not Safe in DC
so Determine Security Domains
and ConTinue building

Assess Risk to System
Select and Document Security Controls
Design Security Architecture
Engineer in Security and Develop Controls
Develop Security Documentation
Conduct Testing

224
Q

Assess Risk to System

A

Outputs - Risk Assessment

225
Q

Select and Document Security Controls

A

Outputs - System Security Plan

226
Q

Design Security Architecture

A

Outputs - List of Shared Services and Shared Risk, Schematic of Security Integration, Identification of Common Controls

227
Q

Engineer in Security and Develop Controls

A

Outputs - Documented in Place Security Control Specification, List of Variations from Plan, Potential Test Scenarios

228
Q

Develop Security Documentation

A

Output - Additional Security Documentation

229
Q

Conduct Testing

A

Output - Test Results and Implications

230
Q

800-64 Development/Acquisition Phase Control Gates

A

Agent of DTeam Reads Player’s Rating For TomoRrow Rowing Match Race

Architecture or Design Review
Performance Review
Functional Test Review
Risk Management Review

231
Q

800-64 Implementation/Assessment

A

IS Enterprise or Starship ASSimilated

Integrate Security into Environments or Systems
Access System Security

232
Q

Integrate Security into Environments or Systems

A

Outputs - Verified List of Operational Security Controls, Completed System Documentation

233
Q

Access System Security

A

Outputs - Security Assessment Report, Input for POA&M

234
Q

800-64 Implementation/Assessment Phase Control Gates

A

Some Tablets are Ready for Roaming like
anDRRoid
Finish Please Soon and Fund Riches so
I can Travel to Delaware or CAlifornia

System Test Readiness Review
Deployment Readiness Review
Final Project Status and Financial Review
IT Deployment or Connection Approval

235
Q

800-64 Operations and Maintenance

A

Review OR Pass Change to Management Committee in CC Mail

Review Operational Readiness
Perform Configuration Management and Control
Conduct Continuous Monitoring

236
Q

Review Operational Readiness

A

Output - Evaluation of Security Implications due to Changes

237
Q

Perform Configuration Management and Control

A

Outputs - CCB Decisions, Updated Security Documentation, Security Evaluations

238
Q

Conduct Continuous Monitoring

A

Outputs - POA&M Review, Documented Results of Continuous Monitoring, Revised Security Authorization Package, Security Reauthorization Decision

239
Q

Operations/Maintenance Phase Control Gates

A

Operational Readiness Review for
Change Control Board to conduct
Plan Of Actions and Milestones Review to determine Authorization Decision

Operational Readiness Review
Change Control Board
POA&M Review
Authorization Decision

240
Q

800-64 Disposal

A

BE Determined Troll
even though you are SMall
Ensure IP for DHS and CS

Build and Execute Disposal or Transition Plan
Sanitize Media
Ensure Information Preservation
Dispose of Hardware and Software
Close System

241
Q

Build and Execute Disposal or Transition Plan

A

Output - Disposal/Transition Plan

242
Q

Sanitize Media

A

Output - Media Sanitization Records

243
Q

Ensure Information Preservation

A

Outputs - Index of Information, Location, Retention Attributes

244
Q

Dispose of Hardware and Software

A

Disposition Records for Hardware and Software

245
Q

Close System

A

Documentation Verifying System Closure

246
Q

800-64 Disposal Phase Control Gates

A

Some Clean Rooms for
Clowns, CowBoys are
Sure to be Ready for their Coming

System Closure Review
Change Control Board
Security Review of Closure

247
Q

800-160 SSE

A

System Security Engineering

248
Q

System Life Cycle Processes

A

Agreement Processes
Organizational Project-Enabling Processes
Technical Management Processes
Technical Processes

249
Q

Agreement Processes

A

Acquisition
Supply

250
Q

Organizational Project-Enabling Processes

A

our prince Leaves Monarchy In Frustration.
Please May Harry Ride Quickly Maybe Kissing Meghan.

LM Life Cycle Model Management
IF Infrastructure Management
PM Portfolio Management
HR Human Resource Management
QM Quality Management
KM Knowledge Management

251
Q

Technical Management Processes

A

Tech Managers Configure and PRIMP for Dairy Queen

CM Configuration Management
PL Project Planning
RM Risk Management
IM Information Management
MS Measurement
PA Project Assessment and Control
DM Decision Management
QA Quality Assurance

252
Q

Technical Processes

A

BAss SNeaks SR ARound
DEan SAys IP INsults
VEry TRicky VAlues OPen MAd DShield

Business or mission analysis (BA)
Stakeholders needs and requirements (SN)
System requirements definition (SR)
Architecture definition (AR)
Design definition (DE)
System Analysis (SA)
Implementation (IP)
Integration (IN)
Verification (VE)
Transition (TR)
Validation (VA)
Operation (OP)
Maintenance (MA)
Disposal (DS)

253
Q

Security Design Principles

A

Security Architecture and Design
Security Capability and Intrinsic Behavior
Life Cycle Security

254
Q

Security Architecture and Design

A

Clear Abstractions
Hierarchical Trust
Least Common Mechanisms
Inverse Modification Threshold
Modularity and Layering
Hierarchical Protection
Partially Ordered Dependencies
Minimized Security Elements
Efficiently Mediated Access
Least Privilege
Minimized Sharing
Predicate Permission
Reduced Complexity
Self-Reliant Trustworthiness
Secure Evolvability
Secure Distributed Composition
Trusted Components
Trusted Communication Channels

255
Q

Security Capability and Intrinsic Behavior

A

Continuous Protection
Secure Failure and Recovery
Secure Metadata Management
Economic Security
Self-Analysis
Performance Security
Accountability and Traceability
Human Factored Security
Secure Defaults
Acceptable Security

256
Q

Life Cycle Security

A

Repeatable and Documented Procedures
Secure System Modification
Procedural Rigor
Sufficient Documentation

257
Q

ARchitecture definition

A

Identify
Develop viewpoints
Harmonize models, views, and secure function
Relate views to design
Select
Manage

258
Q

DEsign definition

A

Prepare
Establish characteristics for system element
Assess alternatives

259
Q

System Analysis

A

Identify problem that requires analysis
Identify and validate assumptions of analysis
Record results of analysis

260
Q

Implementation

A

Build or adapt system elements
Develop training materials
Record results and any anomalies
Maintain traceability

261
Q

Transition

A

Identify training
Demonstrate achievement of security aspects
Commission for operation
Record security aspects of transition and anomalies encountered

262
Q

MAintenance

A

Define maintenance strategy
Review incident reports to identify maintenance needs
Implement restoration after failure
Identify when maintenance is required
Perform logistics support
Manage maintenance and logistics

263
Q

800-64 to 800-160 map

A

Initiation - Stakeholders Needs
Development/Acquisition - Architecture, Design
Implementation/Assessment - System Analysis, Implementation
Operations/Maintenance - Transition, Maintenance

264
Q

Threat Injection

A

A1

Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent
to an interpreter as part of a command or query. The attacker’s hostile data can trick the
interpreter into executing unintended commands or accessing data without proper authorization.

Controls: Parameterize queries, Validate all inputs

265
Q

Threat Broken Authentication

A

A2

Application functions related to authentication and session management are often implemented
incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit
other implementation flaws to assume other users’ identities temporarily or permanently.

Controls: Implement identity and authentication controls

266
Q

Threat Sensitive Data Exposure

A

A3

Many web applications and APIs do not properly protect sensitive data, such as financial,
healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit
card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra
protection, such as encryption at rest or in transit, and requires special precautions when
exchanged with the browser.

Controls: Implement appropriate access controls, Protect data, Encryption protection of sensitive data, Error and exception handling

267
Q

Threat XML External Entities (XXE)

A

A4

Many older or poorly configured XML processors evaluate external entity references within XML
documents. External entities can be used to disclose internal files using the file URI handler,
internal file shares, internal port scanning, remote code execution, and denial of service attacks.

Controls: Validate all inputs

268
Q

Threat Broken Access Control

A

A5

Restrictions on what authenticated users are allowed to do are often not properly enforced.
Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access
other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.

Controls: Enforce access controls

269
Q

Threat Security Misconfiguration

A

A6

Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure
default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured
HTTP headers, and verbose error messages containing sensitive information. Not only must all
operating systems, frameworks, libraries, and applications be securely configured, but they must
be patched and upgraded in a timely fashion.

Controls: Web server configuration hardening

270
Q

Threat Cross Site Scripting (XSS)

A

A7

XSS flaws occur whenever an application includes untrusted data in a new web page without
proper validation or escaping, or updates an existing web page with user-supplied data using a
browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the
victim’s browser which can hijack user sessions, deface web sites, or redirect the user to
malicious sites.

Controls: Encode data

271
Q

Threat Insecure Deserialization

A

A8

Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not
result in remote code execution, they can be used to perform attacks, including replay attacks,
injection attacks, and privilege escalation attacks.

Controls: Verify for security early and often

272
Q

Threat Using Components with Known Vulnerabilities

A

A9

Components, such as libraries, frameworks, and other software modules, run with the same
privileges as the application. If a vulnerable component is exploited, such an attack can facilitate
serious data loss or server takeover. Applications and APIs using components with known
vulnerabilities may undermine application defenses and enable various attacks and impacts.

Controls: Take advantage of security frameworks and libraries

273
Q

Threat Insufficient Logging and Monitoring

A

A10

Insufficient logging and monitoring, coupled with missing or ineffective integration with incident
response, allows attackers to further attack systems, maintain persistence, pivot to more systems,
and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over
200 days, typically detected by external parties rather than internal processes or monitoring.

Controls: Error and exception handling, Implement logging and intrusion detection

274
Q

Software configuration management (SCM) should primarily address which of the following questions?

A

What constitutes a software product at any point in time?

275
Q

The security-planning document developed in the development/acquisition phase of a system development life cycle contains what?

A

Configuration management plan
Contingency plan
Incident response plan
Plan of actions and milestones
System interconnection agreements
Security tests and evaluation results
Rules of behavior
Risk assessment
Security awareness and training plan

276
Q

Boundary-value analysis is conducted in which of the following phases of a system development life cycle (SDLC)?

A

Implementation

277
Q

Which of the following application settings used to prevent malware incidents will help stop phishing and spyware delivery?

A

Blocking Web browser pop-up windows
Filtering spam
Filtering website content

278
Q

In a distributed computing environment, replicated servers could have negative impact on what?

A

Scalability

279
Q

Which of the following security principle balances various variables such as cost, benefit, effort, value, time, tools, techniques, gain, loss, risks, and opportunities involved in a successful compromise of security features?

A

Work factor

280
Q

Which of the following is similar to security certification and accreditation?

A

Quality control

281
Q

What is true when dealing with security principles for securing an application environment?

A

Data-hiding techniques should be practiced during program testing and software maintenance.
Design for protection mechanisms should be simple and small in size.
Information security functions should be isolated from non-security functions.

282
Q

Big bang software application testing approach

A

a testing approach where all the individual components or modules of a software application are tested together, often in a single, comprehensive testing phase. Unlike other testing methods that involve incremental integration and testing of components, Big Bang Testing focuses on evaluating the entire system’s functionality as a whole.

This approach is typically employed after the individual units or modules have undergone unit testing. Once these units are ready for integration, they are combined in a “big bang,” and testing is carried out on the complete system.

283
Q

Finite State Machines are used in what phase?

A

Initiation

Cyber Security (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions