Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP 2023 Prep > Domain 8: Software Development Security > Flashcards

Domain 8: Software Development Security Flashcards

1
Q

DAST

A

Dynamic Application Security Testing

Scans, enumerates, and runs synthetic transactions agains apps runtime services to assess security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Buffer overflow

A

A buffer overflow occurs when an application buffer is populated with data that exceeds the capacity allocated to it, causing the excess data to “overflow” into adjacent memory (thereby overwriting it with the excess data). Buffer overflow attacks exploit this to overwrite memory locations that contain application code with malicious code (that is incorporated into the excess data).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Agile

A

The Agile model allows for developers to jump from one process to another, editing as they desire based upon customer needs.

Developed in mid 1990s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Waterfall

A

The waterfall method does not allow developers to go backward and fix changes, making any development typically permanent.

6 total stages:

  1. System requirements / Feasibility
  2. Software requirements / Analysis
  3. Design
  4. Code and debug / Implement
  5. Testing
  6. Operations and maintenance

Developed in 1970

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Spiral software development

A

The spiral method will allow a developer to eventually come back and fix something, but they won’t have more than a few chances and they must wait to implement the changes.

The spiral model has an emphasis on risk analysis and prototyping.

Developed in 1988

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Integrated development environment

A

These refer to development environments that are designed to help maximize developer productivity and provide re-usable components with the same or similar interfaces. They typically present a single architecture in which the development can be done. An IDE typically has these components:

Sometimes linux distros can be considered an IDE as well.

Source code editor
Build automation tools
Debuggers
Class browser
Object browser
Class hierarchy diagram
Version control to help develop graphical user interfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Fail-Secure

A

The fail-secure failure state puts the system into a high level of security (and, in some cases, disables it entirely) until an administrator has the chance to diagnose the issue and restore the device to regular operation. T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Capability Maturity Model (CMM)

A

The software capability maturity model is based on the principle that a mature software development process will produce quality software.

5 categories of maturity level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

T/F Viruses can reproduce without a legit host application.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SCMM

A

Software Capability Maturity Model

Same as CMM -capability maturity model

The software capability maturity model is based on the principle that a mature software development process will produce quality software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Object-Oriented Programming

A

Object-Oriented Programming (OOP) relies on the relationship between classes and objects. Objects inherit information from their assigned class. This allows programmers to be more efficient with their code. OOP code scales better and is easier to modify.

Examples, Java, .NET, C++, Python

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Referential Integrity

A

Database concept

Requires that the foreign key be equal to the valid primary key of a different table.

Foreign Key = value that references the primary key of a tuple in a different table

Primary Key = unique value for each tuple in a table. Usually the first column of a table but not always.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Types of Databases

A

Relational,

Object-oriented

Hierarchal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Relational DB

A

Consists of flat, two-dimensional tables of rows and columns. Similar to a spreadsheet file. Provides for one to one data structure/mapping.

Relation = the entire table
Attribute = column
Tuple = row
Domain of an attribute = number of allowable values that attribute can take

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Hierarchal DB

A

Combines records and fields that are related into a logical tree structure. Results in a ‘one to many’ data model where each node may have zero, one, or many children but only one parent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Object Oriented DB

A

Designed to resolve some of the limitations of large relational databases. Object-oriented databases don’t employ advanced language such as SQL but support modeling and the creation of data as objects.

Works with traditional database information and also complex data types such as diagrams, schematic drawings, videos, and sound and text documents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SAMM

A

Software Assurance Maturity Model

A software assurance maturity model (SAMM) ensures proper development practices in software by combining five major aspects of the process into a framework to promote security. Essentially, SAMM ensures software development includes governance, design, implementation, verification, and operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IDEAL Software Dev model - what does it stand for? How many phases?

A

The IDEAL software development model has 5 phases. The phases are as follows:

Initiating
Diagnosing
Establishing
Acting
Learning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Interpreted vs Compiled languages

A

Compiled language: programmer uses a tool called complier to convert source code int an executable file for use on specified OS. Example, C, Java, Fortran

Interpreted: Code is distributed in the original code as intended by programmer. User could conceivably open source file and see exact code. Ex. Python, R, JavaScript, VBScript

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Security Onion

A

SIEM/IDS/IPS tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Try…Catch function

A

Is an example of error handling used in software development. It’s a form of input handling in the event a user enters an unexpected input value.

Exception handling is closely related to error handling, except the exception handling technique doesn’t seek to execute the code in error. Error handling does in fact execute the code in error in an attempt to still manage it properly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Error Handling

A

Inclusion of code that attempts to handle errors when they arise before they cause harm or interrupt execution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Exception Handling

A

Programmer codes in mechanisms to anticipate and defend against errors in order to avoid termination of execution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Inheritance

A

The process whereby an object receives some of its characteristics from a class.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a Row called in a relational database?

A

Tuple OR records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Output Encoding

A

Output encoding is an application security technique used to ensure that certain characters within form inputs are processed as data and not potentially misinterpreted as programming syntax (which could be used to inject malicious code, if processed).

For example: The conversion of certain characters within website form inputs (e.g., ‘) into their HTML character entity reference equivalents (e.g., &apos) prior to processing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SDx

A

Software Defined Everything: Software-defined everything (SDx) refers to replacing hardware with software through virtualization.

i.e. VMs, SD Networking, Virtual SAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

ACID Test

A

Atomicity, Consistency, Isolation, Durability (ACID) are a set of properties that ensure data written to the database is accurate and trustworthy.

Atomicity – Ensures that the entire transaction is successful or it is rolled back. If a portion of the transaction fails, everything is rolled back as if none of the transaction took place.

Consistency – Ensures that transactions cannot bring the database from a valid state to an invalid state. All records must follow the database rules. For example, records must have a primary key.

Isolation – Ensures that concurrent transactions do not interfere with each other.

Durability – Ensures that the changes will remain after a transaction is completed and cannot be rolled back.

29
Q

Logic Bomb

A

Logic bombs are programs or code that execute when certain conditions are met. It is common for IT or development personnel to hide malicious programs somewhere in a computer network that executes if their user account is ever disabled.

30
Q

Is Security a standard component/consideration of DevOps?

A

NO

31
Q

Agile Manifesto

A

The Agile Manifesto is a document created in 2001 that defines the core philosophy of the Agile development model. Has 12 principles.

32
Q

PAAS

A

Platform as a Service: Provides consumer with compute platform, including hardware and OS, and runtime environment.

33
Q

Heuristic detection

A

Heuristic detection, sometimes called behavior detection, analyzes the characteristics and structure of code to detect malware. If the code has too many negative characteristics, it will be quarantined.

Ex. looks for attempts to elevate privilege, cover electronic tracks, and alter unrelated or OS files.

34
Q

Is Python an example of PAAS?

A

Python is a platform as a service (PaaS) because it’s a programming tool serving as a platform off of which to design other programs and applications.

In context of CISSP, most coding languages may be considered PAAS.

35
Q

What gen is Assembly Language?

A

Gen 2

Assembly is a generation two language. Assembly is a very low-level language that requires intricate knowledge of the system’s architecture. Programs written in Assembly are hardware-specific and are not compatible between different central processing unit (CPU) types.

36
Q

Gen 1 code

A

written in binary

37
Q

Gen 2 code

A

Assembly

38
Q

Gen 3 code

A

Uses meaningful words in mostly English for commands; e.g. COBOL, Java, and C.

39
Q

Gen 4 code

A

report and application generators. Examples SQL, Foxpro, Focus

40
Q

Gen 5 code

A

Natural language interfaces (aka: constraint based or logic programming), requires an expert system or AI, typically has visual tools to help with programming and does not require the developer to learn a specific language.

41
Q

SQL Candidate key

A

This key can be used to identify any record.

Each table may have one or more candidate keys, but one candidate key is special, and it is called the primary key.

42
Q

Rootkit

A

A rootkit is used to achieve or maintain elevated privileges on a victim’s host. Rootkits frequently masquerade as system-level services to help remain undetected. Rootkits often have kernel-level access and are very difficult to detect or remove.

43
Q

DAST

A

Dynamic Application Security Testing

44
Q

ODBC

A

Open Databse Connectivity

Is a database feature that allows applications to communicate with different types of databases without having to be directly programmed for interaction with each type. ODBC acts as a proxy between applications and back-end database drivers, giving application programmers greater freedom in creating solutions.

45
Q

Code Versioning

A

Code versioning forces developers to document each revision or change in a codebase. All changes are tracked and saved. Organizations should use code versioning to review changes made to code or roll changes back if needed. Common examples of code version control software are GIT and SVN.

46
Q

Reasonableness check

A

A reasonableness check ensures that data outputted from software falls within the specified boundaries. For example, ensuring that a person’s height is not negative or more than 10 feet.

47
Q

COTS

A

Commercial-Off-The-Shelf [software]

Examples of well-known COTS applications include Microsoft Office, Intuit QuickBooks, and Adobe Creative Cloud.

48
Q

Software escrow

A

A software escrow process is when a third party maintains the source code in the event that a customer needs it when a vendor or company that initially developed the code no longer exists.

49
Q

Six Sigma

A

Six Sigma is a process improvement methodology, not a software development methodology. Six Sigma is focused on quality management and is part of quality assurance (QA) and testing.

50
Q

Secondary Storage

A

Secondary storage is inexpensive and nonvolatile and includes items such as hard drives, flash drives, and CDs/DVDs.

All familiar log-term storage devices that are used everyday.

51
Q

Portable Code

A

Portable code is code that can function in any environment without a compiler. This code is typically found in a runtime environment. Specifically, it is the code providing the functionality of an operating system for a virtual machine, for example. These file types can often be seen as “.iso” images.

52
Q

Session hijacking

A

Session hijacking occurs when captured authentication details are utilized by a malicious actor to assume the identity, and act on behalf of, one of the parties in that session, to the other party.

53
Q

Gantt Chart

A

Type of bar chart that shows interrelationships over time between projects and the schedule. Helps plan, coordinate, and track specific tasks.

54
Q

What is the most common character used in a SQL injection attack?

A

The single quote ‘

This is used in normal SQL queries and must be handled carefully on web forms.

55
Q

SW-CMM

A

Software Capability Maturity Model:

5 phases

  1. Initial
  2. Repeatable
  3. Defined
  4. Managed
  5. Optimizing
56
Q

Scrum

A

Methodology for managing software development. Included daily standup meetings called Scrums. Sprints are short periods of intense activity of 1 to 4 weeks.

57
Q

Change management Step 1

A

Request Control

Requests for change are made, managers review, developers prioritize tasks

58
Q

Change management Step 2

A

Change Control

Develpers re-create the situation encountered by the user to analyze changes to remedy situation.

59
Q

Change management Step 3

A

Release Control

Once changes are finalized, they must be approved for relase. Double checkin gis done, and any code added as a debugging aid is removed.

60
Q

Worm vs Virus

A

Worms self-propogate independently, viruses do not. Viruses require a host action.

61
Q

Privacy by Design

A

PbD

Proactive not Reactive; Preventative not Remedial
Privacy as the Default Setting
Privacy Embedded into Design
Full Functionality — Positive-Sum, not Zero-Sum
End-to-End Security — Lifecycle Protection
Visibility and Transparency – Keep it Open
Respect for User Privacy – Keep it User-Centric

62
Q

What is a Thread

A

A thread is an individual instruction set that must be worked on by the CPU. Threads can execute in parallel with other threads that are part of the same parent process. This is known as multithreading.

63
Q

Persistent vs non-persistent XSS

A

Cross site scripting

If the XSS is injected to a site and now lives there - it’s considered persistent.

64
Q

Fagan Inspection

A

Code review process that has 6 steps.

Planning, overview, prep, inspection, rework, and follow-up

65
Q

Keep it Simple

A

AKA KISS

Idea that you don’t un-necessarily over-complicate a piece of software or a system.

66
Q

Define “Class” in Object Oriented Programming

A

Many objects with similar callable methods are considered to be in the same ‘class.’

67
Q

Cardinality - in a DB

A

number of tuples (rows) in a DB table

68
Q

Degree - in a DB

A

Degree = number of attributes (columns) in a table

CISSP 2023 Prep (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions