Eigen vragen

Question 1

What are ways to handling risks

Answer 1

• Ignore
• Avoid
• Mitigate
• Accept
• Transfer

Question 2

What is Risk appetite

Answer 2

Risicobereidheid is het risiconiveau dat een organisatie bereid is te aanvaarden bij het nastreven van haar doelstellingen, en voordat wordt bepaald dat actie moet worden ondernomen om het risico te beperken.

Question 3

Noem een paar Best practises

Answer 3

Owasp

ITIL

Question 4

Noem de 2 approach

Answer 4

Reactive: How to crash a computer, hacker

Proactive approach: Create a secure systems. mitigate threats upfron. secure design

Question 5

SQL Injection

Answer 5

Een SQL-injectie is een soort cyberaanval waarbij een hacker een SQL-codefragment (Structured Query Language) gebruikt om een database te manipuleren en om toegang te verkrijgen tot mogelijk waardevolle informatie.

Question 6

XXE

Answer 6

• An XML External Entity attack is a type of attack against an
application that parses XML input.
• This attack occurs when XML input containing a reference to an
external entity is processed by a weakly configured XML parser.
• Mitigation:
• The XML processor should be configured to use a local static DTD
and disallow any declared DTD included in the XML document

Question 7

CSRF

Answer 7

In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user’s account.

Question 8

what is Non-repudiation

Answer 8

Onweerlegbaarheid. Iets is gebeurt en dit is niet te weerleggen. Je tekent met je private key jou digital singnature die met een public key wordt ge decrypt om er zeker van te zijn dat dit bericht niet veranderd

Question 9

Noem de random modules

Answer 9

os.urandom
/dev/urandom
XOR relies on randomness

Question 10

Eigenschappen symmetric

Answer 10

Same key to encode / decode.
• Key exchange problem:When these keys are shared over an unsecured connection, they are vulnerable to being intercepted by malicious third parties

• Block-based or Stream-based
• Relatively Fast (disk-encryption)
• Modes: to encrypt large plaintext

Question 11

Eigenschappen assymetric

Answer 11

• Different key to encode / decode.
  • Public key can be published
  • Limited code-space
  • Relatively Slow

Question 12

Noem de guidelines

Answer 12

How to program
How to review
how to test
how to deploy

Question 13

Redenen voor zwakheden in code

Answer 13

• Gebruik maken van shortcuts
• Gebrek aan kennis
• Focus op resultaat ipv kwaliteit

Question 14

Wat is test as specification

Answer 14

• Test define behavior

* Create test together with specification

Question 15

What is regression Test

Answer 15

Regression Testing is defined as a type of software testing to confirm that a recent program or code change has not adversely affected existing features. To not allow new features to break the current software

Question 16

Noem examples of Hardening

Answer 16

Removal of maintenance hooks
Removal of debugging code and flags in code.
Removal of dead code / unused code
Removal of comments

Question 17

Noem voorbeelden van Defence in dept(DiD)

Answer 17

Access rights
Elevated accounts
Account per application (or sub-application)
Separate read-only for modifiable data (static / dynamic)
Restrict use of resources
Be aware of command-escapes in the program.
Restrict Sudo

Question 18

Hoe kun je een programma monitoren

Answer 18

Check program against signature
           - Read-only
Check running processed
           - Unexpected processed / Missing processes
Check network ports and connections
            - Unexpected listens
             - Unexpected src/dst ip's 
              - Unexpected ports
Check filesystem
             - Unexpected files in directories
Check logfiles
              - Unexpected error, Exceptional cases

Question 19

Noem de controls(Les4)

Answer 19

Detective controls
Preventive controls
Deterrent controls
Corrective controls
Compensating controls