Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Chapter 8: Software Development Security > Flashcards

Chapter 8: Software Development Security Flashcards

(78 cards)

Start Studying
1
Q

Abstraction

A

Information Hiding - focus on big picture….

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

aggregation

A

pulling bits of different data together then make an assumption via inference…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Agile Model

A

most common

very flexible in nature

requirements to change throughout. good for when projects requirements change a lot.

Pros:

  • fewer defects
  • greater flexibility
  • immediate feedback

cons:

  • Less Documentaion
  • Less focus on system design.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Atomicity

A

A transaction is fully complete or it is rolled back All or Nuthin looking for the “commit message”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Attributes - Object Oriented Technology

A

Descriptors for each class

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

auditing

A

create audit policy to track actions to a subject.

audits can be use to :

  • ensure policies are being followed/are effective
  • marke sure hat individual user accounts aren’t unntentinoally being allowed to accumulate rights/permissions.
  • check the accuracty and completeness of transactions that are authorized
  • privileged actions are restriced to authorized personnnel.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Backdoor

A

Usually created by software developers for an emergency entry into a system. Example may be a hotkey in the event that a password is not available for access. Obviously can be used by anyone with such knowledge to gain access into the system. A trapdoor is rather created via malicious activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

brocken auth & session mgmt

A

applications fuctions related to authentication and session managment are often no implemented correctly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Capability Maturity Model Integrated - CMMI

A

from carnegie mellon an organization’s project management’s process can be ranked on their maturity and can be ranked 5 levels. 5 best most orgs want a level3 “i really don’t mind oranges” 5 levels: Initial-caotic and heroic effort Repeatable- trying to get processes going…time, scop Defined: Project management office Managed- good understanding of process and product Optimized - associated with Kiazen, CPI continue process improvent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cardinality

A

the number of rows in a relation one to many (such as customer to orders made)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CGI

A

common gateway interface

does the input validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Classes - Object Oriented Technology

A

Defines attributes, characteristics, and behaviors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Code Injection

A

Looking at language of database and issuing commands.

Entering malicous code into webforms. no brackets, drop-table..input validation

make sure no data control language entered.

data type… only specific data

drop downs etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Cohesion

A

Singleness of purpose - you want HIGH cohesion both have H’s :)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Consitencey

A

Enforce any rules that are system defined or Administrator define

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Coupling

A

the dependency between modules - sharing same code for other apps. LOOSE coupling both have L’s in them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CSRF

A

Cros site request forgery

takes advantage of a webite’s trust in a user

two sessions going on across user’s computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Data Marts

A

Often regional collection of info from database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data Mining

A

process of pulling info from data warehouse by utilizing meta-data. police mining info about perps…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Warehouse

A

collection of information from data marts….think of meth..example.. law enforments pull mull all store info into warehouse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Database Design - ACID test

A

Atomicity Consistency Isolation Durability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DB Aggregation & Inference

A

a way of gathering information and coming to a conclusion based on that. code injection is only computer based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Degree

A

the number of columns in a relation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Distributes Databases

A

Client-server type of DB located on more than one server distributed in several locations Synchronization accomplished via a two-phase commit or replication methods Data accessible in a single search function despite separate location DNS Data Base Is an example

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Due Diligence
is reseach due care is action... enact policies etc...
26
Durability
You can't roll back a transaction you got to start over
27
elite
high level database peeps...
28
Entity Integrity
Primary Key field can't be null
29
Foreign Key
Primary key from one table appears in a secondary table
30
Hacker
Someone that is very good with computers... white hat hackers - PEN testers black hat - ill intent grey hat - in the middle...
31
Hierarchical Database
Stores related info in a tree-like fashion. Info traced from major group to sub-group Predetermined access paths to data data traced through parents (hierarchy) "inverted tree"
32
Inference
making assumptions from the aggregated info
33
Inheritance - Object Oriented Technology
Objects inherit attributes and behaviors from super class
34
IPv6
128 bits Hexidecimal NAT has make lack of IP's not as big as a deal... ipv4 is unsecured... using as example as talking about unsecure software... lack of security integration.. etc.
35
Isolation
until commit message is received the transaction is invisible
36
masking
blocking out sensitive information...
37
Messages - Object Oriented Technology
means of communication by objects
38
metadata
"data about data" like controlled substance purchase
39
Methods - Object Oriented Technology
functionality performed by objects
40
Monitoring the program
Consistency: results are the same data Quantative: precise, objective, numberic values Objectivity: unbiased Reveleance- shoudl have a direct bearing on a desision inexpensive: should be cost effective.
41
NFC
Near field communications like the hotel key cards.
42
Normalization of Database
no duplicates- every table describes the primary key
43
Object Oriented Database
Modular and re-useable by design (probably not testable)
44
Objects - Object Oriented Technology
collection of attributes for a single instance
45
OWASP
Open web application security project publish to 10 list of most commonly orchestrated attacks international non-profit
46
Polyinstantiation
to Lie....multiple instances of an event. Provide false info to people that don't have clearance. bogus info at lower levels making the information boring though lying... ;)
47
Polymorphism
capability of different objects to respond differently to same message
48
Primary Key
the unique identifier that ties all the tables together ie: customer number
49
Prototyping Software Approach
Pros: feedback directly from users client and contactor can work very closely also allow software engineer some insight into the accuracy of initial project estimates and wether the deadlines and milestones can be met sucessfully. cons: clients rarely understand all teh ramifications of proposed changes.
50
Referential Integrity
Can reference a non-existing key
51
Relational Database
uses tables ie: columns and rows. A DB in the form of tables (rows & columns) related to each other Stores data in such a way that a data manipulation language can be used independently on data Uses a database engine (Oracle, Sybase, etc.)
52
RFID
Radio Frequecy ID like fast pass credit cars passports...
53
rich internet apps client side threats 2 of them
cross side scripting xss - attacker takes advantage of website that doesn't provide validation - code injection "takes advantage of user's trust of website" CSRF Cross site request forgery attack take advantage of two session going on at two times...messaging with attacker. bof a account has been compromised....etc. help to troubleshoot problems...steal that session info.. "takes advantage of a website's trust in a user"
54
Rootkits
Malicious code that is intended to take full or partial control of a system at the lowest level (core or kernel). They often hide themselves from monitoring or detection and modify system files. Most rootkit infections install back trapdoors, spyware, or other malicious codes once they gain control of the target system.
55
Script Kiddies
someone that has no real talent but can copy and paste borrowed code... deragatory term... Still pose a threat... don't understand ramifications...
56
Service Oriented Architechture
SOE is an architecture and a vision on how heterogeneous application should be developed and inegrated in the enterprise share a formal contract loosely coupled abstraction composable reusable autonomous standard operating stuff...
57
Spiral Software Approach
combo of waterfall :stepping + circular nature of prototyping = spiral dev. Pros: High amount of risk analysis good for large and mission critical projects software is produced early in software life cycle. Cons: can be costly risk analysis requires specific expertise project's success is highly dependent of the risk analysis phase. not for smaller projects.
58
trojan horse
Malicious code that masquerades as a harmless file. It usually performs a variety of actions, including key-logging, opening the computer to further attacks, destroying data or files, among others.
59
Tuples
Rows...across in relational databases
60
virus
spreads from computer to computer via attaching itself to other file...requires user input
61
Waterfall Software Dev. Approach
a phased based approach one step after another.. better for shorter lived projects. Pros: * each phase specific deliverables * phases are processed and competed one at a time. * best for small projects * it reinfoces "define before design" and "design before code. Cons: * Adjusting scope during life cycle can kill a project * no working software until late in the gem * high risk, uncerainty * poor model for long and ongoin projects * poor model high probability of chance.
62
Why is software unsecure
lack of training lack of funding no priortiztion of security security as afterthought
63
Worms
malicious code that spread around a network on its own. self-replicating
64
XSS
takes advantage of trust of a website cross site scripting... not good input validation... allows attacker to exectue scrips in the victim's browser which can hijack user's sessions.
65
Insecure direct object references
defined as an authorized user or process which can invoke the internal functionality of the software by manipulating parameters and other object vales that directly refernce this functionality resulting it problems...
66
sensitve data exposure
owasp 6 http vs https...etc.
67
missing function level access control
changing parameters in url to gain access to information u should have access to.
68
owasp 9 known vulnerablity component usage
components such as libraries frameworks and other software modules, almost alway run with full software priveleges. don't use old crappy code..
69
owasp 10
unvalidated redirects and fowards make sure we're redirected in valid mannar...
70
71
Defensive coding
proactive, secure coding intended to ensure the continueing function the softwarer under unforseen cicumstances: Examples: Input validation Sanitization - more generic info for example/output sanitization error handling - non verbose safe API's concurrency - use file lockimg tokenizing- replace sensitve data with unique id's. sandboxing apps. anti-tampering- code signing/obfuscation versioning code analysis/code review
72
Change Management
changes must be controlled there has to be a process. should happen in a stuctural way. make sure everything is documented..
73
whitebox/clearbox testing
test has access to all the code.
74
blackbox testing
Zero knowlege attack.
75
fuzzing
fault injection to see if anything is successful brute force of testing ..... challenges input validation. buffer overflow error...etc.
76
scanning
passive map the enviornment ident. server verions open ports and running services. types: Vulnerability scan Content Scan Privacy Scan - to detect privacy violations..
77
Database Models
1. hierarchical - top down 2. distributed - DNS no single server 3. object oriented - re-usable and modular in nature. 4. relational database - sql, oracle, table/fields..etc.
78
what condition is necessary on a web page for it to be used for a cross site scriptign attack
reflected-input

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions