Chapter 20 Flashcards
(30 cards)
Programming language generations
Gen 1: Machine language; 0 and 1 computer directly understands
Gen 2: Assembly language; mnemonics
Gen 3: Structured, object oriented, etc.
Gen 4: Domain-specific
Gen 5: AI, natural language
Compiled vs Interpreted
Compiled - no source code, but easier to hide malware
Interpreted - need source code
Run-time environment
Portable across different OS platforms
Software libraries
Re-usable code; need to be aware of origins of source code
Software failure mitigation
Input validation
Authen and session mgmt
Error handling
Logging
Fail secure
SDLC
Conceptual definition
Functional specifications - input/behavior/output
Controls specifications
Design
Coding
Code review
Test
Maintain and change mgmt
SDLC models
Iterative Waterfall - with feedback for one phase back only
Spiral - repeated waterfall iterations; each one delivering a prototype until finished product
Agile development
Individuals and interactions over processes and tools
Working software over comprehensive documentation
Customer collaboration over contract negotiation
Responding to change over following a plan
Scrum, scrum master, sprints
Agile - 12 principles
- Highest priority - satisfy customer thru early delivery
- Welcome changes
- Deliver working software frequently
- Business and dev work together
- Build around motivated people - provide support and trust
- Face-to-face communication
- Primary measure of progress is working software
- Maintain constant pace indefinitely
- Attention to technical excellence and good design
- Maximize work not done
- Self-organizing teams produce best
- Regular review and adjust
SW-CMM
(Software Capability Maturity Model)
Lvl 1: Initial
Lvl 2: Repeatable - basic lifecycle mgmt, reusable code, repeatable project outcomes
Lvl 3: Defined - standard processes, orgranizational processes, training program
Lvl 4: Managed - use metrics, quantitative measurement and quality mgmt
Lvl 5: Optimizing - change mgmt
Scaled Agile Framework (SAFe)
- apply Agile principles and practices to large enterprises
4 configuration levels:
1. Essential SAFe - traditional Agile; Agile release trains (ART) in 8-12 week program increments
2. Large solution SAFe - vast systems; multiple ARTs
3. Portfolio SAFe - strategic direction translated to actions
4. Full SAFe - combi of all
SAMM - software assurance maturity model
5 business functions:
- Governance - strategy, compliance, metrics, training, policy
- Design - threat assessment, security req, security arch
- Implementation - secure building, secure deploy
- Verification - testing
- Operations - incident mgmt, operational mgmt env mgmt
Total of 15 security practices
IDEAL
Initiating
Diagnosing
Establishing
Acting
Learning
Change Management
Request control processes - request, cost/benefit, prioritize
Change control processes - test and document
Release control processes - approvals, user acceptance, deployment
Software Configuration Management (SCM)
Configuration identification - document configurations
Configuration Control - authorize changes, versioning
Configuration status accounting - change tracking
Configuration Audit - regular check for unauth changes
DevOps
DevSecOps
Dev/QA/Ops
Dev/QA/Sec/Ops
Continuous integration / continuous delivery (CI/CD)
SW testing methodologies
White box testing - access to code; analyze inner workings
Black box testing - from user perspective; input scenarios; no access to code
Gray box testing - combi of white and black; source code for test design; does not analyze inner workings
Commercial off the shelf software (COTS)
Open source software (OSS)
Must test for security vulnerabilities
- Conduct own testing
- Rely on vendor test results
- or 3rd party testing
DBMS data models
Hierarchical - one-to-many
Distributed - data store on different DB’s; many-to-many
Relational
Relational DB’s
2D table
row and column - relation
Row - cardinality
Column (Field) - degree
Domain - range of values of attribute (field)
Candidate keys
Primary key
Alternate keys
Foreign key - enforce Referential Integrity, key is a primary key in the referenced table
SQL
DDL - data description language; create/mod schema
DML - data manipulation language; interaction with data in schema
ACID model
RDBMS transactions must be:
1. Atomic - all or nothing; if any part of transactions fails, entire trans must be rolled back
2. Consistent - db rules must be maintained before and after transaction
3. Isolation - current transaction must complete before exec the next
4. Durability - changes must be preserved; via transaction logs for back up mechanism
DB contamination
DB contains data of different security levels
Concurrency
Lock access to data for transaction; prevents dirty reads and lost updates
