Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

- > Domain 8: Software Development Security > Flashcards

Domain 8: Software Development Security Flashcards

1
Q

Types of programming languages

A
  1. Interpreted Languages: such as Python, R, and Javascript. This is where the source code itself is distributed and the interpreter executes the source code on their system.
  2. Compiled Languages: Such as C and Java, they must be compiled before use in an executable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Key phases of SDLC

A

5 Key Phases:

  1. Initiation
  2. Development/acquisition
  3. Implementation/assessment
  4. Operation/maintenance
  5. Disposal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is initiation (SDLC)?

A

Process of determining feasibility, cost, risk analysis, getting management approval, and establishing basic security objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is development/acquisition phase (SDLC)?

A

Define security architecture, perform risk assessment, determine initial security controls and countermeasures, and document security controls and concept of operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is implementation/assessment (SDLC)?

A

Test, evaluate and deploy the new system into operations. This includes performing a security assessment to determine security posture, implementing corrective actions to weak security controls, and getting certification and accreditation for the new system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the software development life cycle? (conceptually)

A

A process designed for the planning, creating, testing, and deploying of an information system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is operations/maintenance phase (SDLC)?

A

System maintenance, includes readiness review to ensure everything is ready to go. Also focuses on configuration management and change control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is disposal phase (SDLC)?

A

System is decommissioned or taken out of operations for termination, upgrade, or replacement. Focus is on the planning for the transfer, protection, or proper destruction of documentation, hardware, and/or software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Three key phases of Change Management process?

A
  1. Request control,
  2. Change control
  3. Release control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain Request Control

A

Provides an organisation framework within which users can request modifications, managers can conduct cost/benefit analysis, and developers can prioritise tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Explain Change Control (Change Management)

A

Provides an organised framework within which multiple developers can create and test a solution prior to rolling it out into a production environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Explain Release Control (Change Management)

A

Once the changes are finalised, they must be approved for release through the release control procedure. Focus is on removing programming aides (such as back doors) and ensure acceptance testing is performed before release.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of the Configuration Management Process?

A

Used to control the version(s) of software used throughout an organisation and formally track and control changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define Configuration Identification (Configuration Management process)

A

Administrators document the configuration of covered software products throughout the organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define Configuration Control (Configuration Management process)

A

Ensures that changes to software versions are made in accordance with the change control and configuration management policies. Updates can be made only from authorised distributions in accordance with these policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Configuration Status Accounting

A

Formalised procedures are used to keep track of all authorised changes that take place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Configuration Audit?

A

Periodic configuration audit should be conducted to ensure that the actual production environment is consistent with the accounting records and that no unauthorised configuration changes have taken place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define Software Capability Maturity Model (SW CMM)

A

It is a 5 level software development maturity model that describes procedures, principles, and practices that underlie software development process maturity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define 5 levels of SW CMM

A
  1. Initiating: competent people, informal processes, ad-hoc, absence of formal process
  2. Repeatable: project management processes, basic life-cycle management processes
  3. Defined - engineering processes, presence of basic life-cycle management processes and reuse of code, use of requirements management, software project planning, quality assurance, configuration management practices.
  4. Managed: product and process improvement, quantitatively controlled
  5. Optimising: continuous process improvement works with an IDEAL model
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define IDEAL model

A

Organizational improvement tool/model, including:
I: Initiate, begin effort. Outline business reasons behind change, support is built for the initiative, and the appropriate infrastructure is put in place.
D: Diagnose, perform assessment of current state and make recommendations.
E: Establish an action plan
A: Implement action plan, including develops solutions and then tests, refines, and implements them.
L: Leverage assessments, and continuously improve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define Gantt Chart and PERT

A

Gantt Charts are a bar chart for project planning timings (including when things are planned to happen). While, PERT is Program Evaluation Review Technique for project scheduling used to judge the size of a software product in development and calculate the standard deviation (SD) for risk assessment. PERT is used to direct improvements to project management and software coding in order to produce more efficient software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define DevOps

A

An approach which aims to resolve issues by bringing the three functions of Software Development, Quality Assurance, and IT Operations together. It is not focused on security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Types of Software Development Models

A
  1. Simplistic: model of continual steps in order
  2. Waterfall: System Requirements –> Software Requirements –> Analysis –> Program Design –> Coding –> Testing –> Operations and Maintenance
  3. Waterfall including Validation and Verification (V&V):. Validation = doing the right job, and verification=doing the job right. This model allows the validation and verification of software at all levels during production.
  4. Spiral Model: Encapsulates a number of iterations of the Waterfall model, including, determining objectives, alternatives, and constraints –> evaluate alternatives, identify and resolve risks –> plan next phases –> and develop and verify next-level product.
  5. Cleanroom: write code correctly first time, quality through design
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Agile Software Development

A

It is an approach to delivering software, with working software being a primary measure of success

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Define database
General mechanism for defining, storing and manipulating data without writing specific programs
26
DBMS
Database Management System, is a suite of software programs that maintains and provides controlled access to data components stored in rows and columns of a table
27
Types of databases
Hierarchical= tree (sons with only one parent), one to many relationship Network=tree (all interconnected) Relational= one-to-one relationships, has has tuples and attributes (rows and columns)
28
DDL and DML
DDL=Data definition language which defines strucutre and schema DML=Data Manipultion Manguage: view, manipulate, and use the database via VIEW, ADD, MODIFY, SORT, and DELETE commands
29
Degree of DB
Number of attributes (columns) in table
30
Tuple
Row or record
31
DDE
Dynamic Data Exchange: enables applications to work in a client/server model by providing the inter-process communications mechanism (IPC)
32
DCL
Data control language: subset of SQL used to control access to data in a database, using GRANT and REVOKE statements
33
Semantic integrity
Makes sure that the structural and semantic rules are enforced on all data types, logical values that could adversely affect the structure of the database. Only allows allowable data to be entered into a row.
34
Referential integrity
All foreign keys reference existing primary keys
35
Candidate Key
An attribute (column) that is a unique identifier, that could be chosen to be a primary key
36
Primary Key
A unique attribute to identify a record in a database.
37
Foreign Key
Represents a record in another table
38
Main components of DB
Schemas (blueprints), tables, and views
39
Incorrect summaries
When one transaction is using an aggregate function to summarise data stored in a DB while a second transaction is making modifications to a DB
40
Dirty reads
When one transactions reads a value from a DB that was written by another transaction that did not commit
41
Lost updates
When one transaction writes a value to the DB that overwrites a value needed by transactions that have earlier precedence
42
Dynamic Lifetime Objects
Objects created on the fly by software in a OOP environment. An object is preassembled code that is a self-contained module.
43
ODBC
Open database connectivity is a DB feature that allows applications to communicate with different types of DBs without having to be directly programmed for interaction with each type. ODBC acts as a proxy
44
Multilevel security
Keeping data with different security requirements separate
45
Database contamination
Mixing data with different classification levels andor need to know requirements and is a significant challenge.
46
Database partitioning
process of splitting a single database into multiple parts, each with a unique and distinct security level or type of content
47
Polyinstantiation
Occurs when two or more rows in the same relational database table appear to have identical primary key elements but contain different data for use at differing classification levels. it is often used as a defense against inference attacks
48
What is the ACID Model? (conceptually)
Critical database theory model to create reliable databases
49
Atomicity
Database transactions must be atomic - they must be an 'all or nothing' affair. If any part of the transaction fails, the entire transaction must be rolled back as if it never occurred.
50
Consistency
All transactions must begin operating in an environment tht is consistent with all of the database's rules (for example, all records must have a unique primary key).
51
Isolation
Transactions operate separately from each other, in order.
52
Durability
Database transactions must be durable, once they are committed to the database, they must be preserved, such as through the use of backups
53
Expert Systems: Knowledge Management
Embody accumulated knowledge of experts on a particular subject and apply it in a consistent fashion to enter decisions. Expert system = inference engine + knowledge base - degree of uncertainty
54
Two components of expert system
Knowledge base and inference engine
55
Knowledge base
Set of rules such as if-then statements
56
Inference system
Analyses information in the knowledge base to arrive at the appropriate decision.
57
Two modes of expert systems
Forward Chaining: acquires info and comes to a conclusion | Backward Chaining: backtracks to determine IF a hypothesis is correct
58
Neural Networks
Use complex computations to replace partial functions of the human mind and works with weighted inputs. Single Layer = only one level of summoning codes Multi Layer = more levels of summoning codes
59
Programming Languages Generations
5 Generations, including: 1. Include all machine languages 2. Include all assembly languages 3. Include all compiled languages 4. Attempt to approximate natural languages and include SQL, for DBs 5. Allow programmers to create code using visual interfaces.
60
Programming Languages tools
Compiler: translates higher level program into an executable file Interpreter: reads higher level code, one line at the time to produce machine instructions Assembler: converts machine-code into binary machine instructions.
61
Object oriented security
Behave as a black box, as they are encapsulated to perform an action. Can be substituted if they have compatible operations. it can store objects like video and pictures
62
Encapsulation for Software development
Only data it needs, no accidental access to data
63
Message
Communication to object to perform an action
64
Method
Code that defines an action an object performs in response to a message
65
Behaviour
Results exhibited by an object in response to a message
66
Class
Collection of methods that defines the behaviour of objects
67
Instance
Objects are instances of classes that contain their methods
68
Inheritance
Allows a subclass to access methods belonging to a superclass
69
Polymorphism
Objects of many different classes that are related by some common super class. When different subclasses may have different methods using the same interfaces that respond differently
70
Object Orientation: Requirements Analysis (OORA)
Defines classes of objects and their interactions
71
OOA, Analysis
Understanding and modelling a particular problem Domain Analysis (DA) seeks to identify classes and objects that are common to all applications in a domain
72
OOD, Design
Objects are the basic units, and instances of classes
73
OOP, Programming
Employment of objects and methods. If class = airplane, objects like fighter plane, cargo plane, passenger plane can be created. Method would be what a plane would do with a message like: climb, dive, and roll.
74
Object Request Brokers
Middlewear that acts as locators and distributors of the objects acros networks
75
CORBA: Standard
Broker architecture enables programmes wittten in different languages and using different platforms and OS's through Interface Definition Languae
76
Common Object Model
Support exchange of objects amongst programs. This used to be called OLE. DCOM is the network variant.
77
Conclusion
Object Orientation supports reuse of objects and reduces development risk, natural in its representation of real world entities
78
Cohesion
Ability to perform without use of other programs, strength of the relationship between the purposes of methods within the same class
79
High cohesion
Without use of other modules
80
Low cohesion
Must interact with other modules
81
Coupling
Effect on other modules. Level of interaction between objects
82
High coupling
Module largely affects many more modules
83
Low coupling
Doesnt affect many other modules
84
Abstraction
Fundamental principle of OOP. Users of an object (or OS component) doesnt necessarily need to know the details of how the object works; they need to know just the proper syntax for using the object and the type of data that will be returned as a result
85
Seperation of privilege
Builds on principle of least privilege. Requires the use of granular access permissions; that is, different permissions for each type of privileged operation. Allows admins to do certain privileged functions, without complete access to system.
86
Process isolation
Requires that the OS provide separate memory spaces for each process's instructions and data. It also requires that the OS enforce those boundaries, preventing one process from reading or writing data that belongs to another process. This prevents unauthorised data access, and protects the integrity of processes.
87
Layering processes
Implementstrucutre similar to the ring model
88
Hardware segmentation
Similar to process isolation, by seperating physical hardware
89
Covert Channels
A way to receive information in an unauthorised manner, information flood that is not protected by a security mechanism.
90
2 Types of Covert Channels
1. Storage Covert Channel: Processes communicate via storage space on the system. For example, writing to storage by one process and reading by another of lower security level. 2. Covert Timing Channel: One process relays to another by modulating its use of system resources. Typing rhythm of Morse Code is an example.
91
Mobile Code: Java
Sandboxes, no warnings, programs are compiled to bytecode
92
Mobile Code: ActiveX
Authenticode, relies on digital signatures, annoying dialogs people click away
93
Malicious Code; Virus
Inserts or atteches itself to file, and is spread through infected media
94
Worm
Reproduces on its own without user action
95
Logic Bomb/Code bomb
Executes when a certain event happens (like accessing a bank account or employee being fired) or a data/time occurs
96
Trojan Horse
Program disguised as a useful program/tool
97
Hoaxes
False warnings like
98
Remote Access Trojan (RAT)
Remote control programs that have the malicious code and allow for unauthorised remote access, back orifice, sub even, net bus
99
Buffer Overflow
Excessive information provided to a memory buffer without appropriate bounds checking which can result in an elevation of privilege. if executable code is loaded into the overflow, it will be run as if it were the program. . Must be corrected in code
100
Backdoor
Program installed by an attacker to enable him to come back at a later date without going through proper authorisation channels, maintenance hook for developers
101
Countermeasures
EAL6 systems have less than EAL3 systems because covert channels are normally a flaw in design
102
LOKI
Tool used for covert channel that writes data directly after the ICMP header.
103
Botnet
Thousands of zombie computers
104
Directory Traversal Attack
Attacker attempts to force the web application to navigate up the file hierarchy and retrieve a file that should not normally be provided to a web user.
105
Macro virus
Most common in office productivity documents, .doc/.docx.
106
Trojans
Pretends to do one thing, while performing another
107
MDM
Software solution to manage the myriad mobile devices that employees use to access company resources. The goals of MDM are to improve security, provide monitoring, enable remote management, and support troubleshooting.
108
Collisions
Two different files produce the same result from a hashing operation
109
Boot sector
Moves or overwrites the boot sector with the virus code
110
System infector
Infects BIOS command, or other system files. It is often a memory resident virus
111
Phlashing
Malicious variation of official BIOS or firmware is installed that introduces remote control or other malicious features into a device
112
Compression
Append to executables
113
Companion Virus
Specific type of virus where the infected code is stored not in the host program, but in a separate 'companion files'
114
Stealth Virus
Hides modification to files or boot records and itself
115
Multipart virus
Infects both boot sector and executable files, becomes resident first in memory and then infects the boot sector and finally the entire system, uses two or more propagation mechanisms
116
Self-garbling virus
Attempts to hide by garbling its code; as it spreads, it changes the way its code is encoded
117
Polymorphic virus
Self garbling virus that changes its pattern each time it spreads
118
Macro virus
Usually written in Word Basic, VBScript and used with MS Office
119
Resident virus
Virus that loads when a program loads in memory
120
Resident virus
Virus that loads when a program loads in memory
121
Master Boot Record
MBR virus attacks the MBR, and virus is stored on another part of memory that is loaded at boot-up
122
Non-resident virus
Attached to .exe
123
Signature Based Anti Virus
Cannot detect new malware, relies on knowledge of existing malware
124
Heuristic behaviour based Anti Virus
Can detect behavior of misbehaving files
125
Protected Domain
Execution and memory space assigned to each process
126
Trusted Computer Base
Combination of protection systems within a computer system, which includes the hardware, software and firmware that are trusted to enforce the security policy
127
Security Kernel
Hardware, software, firmware, elements of TCB that implement the reference monitor concept - must be isolated from reference monitor
128
Reference Monitor
Isolation, completeness and verifiability, that compares the security labels of subjects and objects
129
Multistate systems
Capable of implementing a much higher level of security. These systems are certified to handle multiple security levels simultaneously by using specialised mechanisms.
130
Protection Rings
4 Protection Rings Ring 0: OS Kernel. Kernel manages the HW and supplies fundamental services that the HW does not provide. Ring 1: Remaining parts of OS Ring 2: I/O drivers and utilities Ring 3: Applications and programs Layers 1 and 2 contain device drivers but are not normally implemented in practice. Layer 3 contains user applications. Layer 4 does not exist.
131
CSRF (XSRF)
Cross Site Request Forgery, attacks exploit the trust that sites have in a user's browser by attempting to force the submission of authenticated request to third party sites
132
Cross Site Scripting
Uses reflected input to trick a user's browser into executing untrusted code from a trusted site
133
Session Hijacking
Attempt to steal previously authenticated sessions but do not force the browser to submit request
134
SQL injection
Directly attacks a DB through a web app
135
BSOD
When Windows crashes into a dangerous failure and enters a full secure state (reboot)
136
Patch management system
Prevents outages from known attacks by ensuring systems are patched. Patches aren't available for new attacks
137
Threat modelling
Reduces the number of security related design and coding flaws, reduce severity of non-security related flaws, not to reduce number of threat vectors
138
Open system
One with published APIs that allow third parties to develop products to interact with it
139
Closed system
One that is propeitary with no third-party product support, does not define if its code can be viewed
140
Open source
Coding stance that allows others to view the source code of a program, distributed free or for a fee
141
Closed source
Is an opposing coding stance that keeps source code confidential. Can be reverse engineered or decompiled
142
Verification
Evaluates the product against specifications
143
Validation
Evaluates how well the product satisfies real-world requirements

- (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions