Secure Software Development

Question 1

SDLC

Answer 1

§ Software Development Life Cycle

§ SDLC is an organized process of developing a secure application throughout the life of the project

Question 2

Least Privilege

Answer 2

Users and processes should be run using the least amount of access necessary to perform a given function

Question 3

Defense in Depth

Answer 3

Layering of security controls is more effective and secure than relying on a single control

Question 4

Structured Exception Handling

Answer 4

SEH Provides control over what the application should do when faced with a
runtime or syntax error

Question 5

Fuzzing

Answer 5

Injection of randomized data into a software program in an attempt to find system failures, memory leaks, error handling issues, and improper input validation

Question 6

Backdoors

Answer 6

Code placed in computer programs to bypass normal authentication and other security mechanisms

Question 7

Directory Traversal

Answer 7

Method of accessing unauthorized directories by moving through the directory structure on a remote server

Question 8

Arbitrary Code Execution

Answer 8

Occurs when an attacker is able to execute or run commands on a victim computer

Question 9

Remote Code Execution (RCE)

Answer 9

Occurs when an attacker is able to execute or run commands on a remote computer

Question 10

Zero Day

Answer 10

Attack against a vulnerability that is unknown to the original developer or manufacturer

Question 11

Buffer Overflow

Answer 11

Occurs when a process stores data outside the memory range allocated by the developer

Question 12

Smash the Stack

Answer 12

Occurs when an attacker fills up the buffer with NOP so that the return address may hit a NOP and continue on until it finds the attacker’s code to run

Question 13

Cross-Site Scripting

Answer 13

Occurs when an attacker embeds malicious scripting commands on a trusted website

Question 14

Cross-Site Request Forgery

Answer 14

§ Occurs when an attacker forces a user to execute actions on a web server for which they are already authenticated
§ Prevent XSRF with tokens, encryption, XML file scanning, and cookie verification

Question 15

XML Bomb (Billion Laughs Attack)

Answer 15

XML encodes entities that expand to exponential sizes, consuming memory on the host and potentially crashing it

Question 16

XML External Entity (XXE)

Answer 16

• An attack that embeds a request for a local resource

* To prevent XML vulnerabilities from being exploited, use proper input validation

Question 17

Race Conditions

Answer 17

A software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events, and those events fail to execute in the order and timing intended by the developer

Question 18

Dereferencing

Answer 18

A software vulnerability that occurs when the code attempts to remove the relationship between a pointer and the thing it points to.

Question 19

Time of Check to Time of Use

Answer 19

The potential vulnerability that occurs when there is a change between when an app checked a resource and when the app used the resource