Secure Software Architecture Glossary

Question 1

Minimising cyber attacks and vulnerabilities

Answer 1

Using strong passwords, updating your software, thinking before you click on suspicious links, and turning on multi-factor authentication.

Question 2

Data protection

Answer 2

Protecting data from unauthorized access, use, disclosure, modification, or destruction. This involves implementing measures like encryption, access controls, and intrusion detection systems.

Question 3

Determining specifications

Answer 3

Identifying and defining security requirements, conducting threat modeling, and establishing secure design principles.

Question 4

Design

Answer 4

Designing systems with security considerations integrated from the outset, rather than as an afterthought.

Question 5

Development

Answer 5

Focuses on integrating security considerations throughout the entire software development lifecycle (SDLC).

Question 6

Integration

Answer 6

Embedding security measures and considerations throughout the entire software development lifecycle and within the system’s architecture.

Question 7

Testing and debugging

Answer 7

In contrast, debugging is the process of correcting or removing bugs or errors found in the testing process.

Question 8

Installation

Answer 8

Implementing strategies and solutions to protect software from unauthorized access, modification, or misuse during the installation process.

Question 9

Maintenance

Answer 9

Ongoing activities to ensure software remains secure after initial deployment.

Question 10

Confidentiality

Answer 10

Ensures that sensitive information is accessible only to authorized individuals, preventing unauthorized access, use, or disclosure.

Question 11

Integrity

Answer 11

Ensures data and systems remain accurate, trustworthy, and free from unauthorized modification throughout their lifecycle.

Question 12

Availability

Answer 12

Ensures authorized users can access and use resources when needed.

Question 13

Authentication

Answer 13

The process of verifying the identity of a user, device, or service before granting access to resources or systems.

Question 14

Authorisation

Answer 14

The process of verifying the identity of a user, device, or service before granting access to resources or systems.

Question 15

Accountability

Answer 15

Ensuring that actions within a system can be traced back to specific individuals or entities, enabling them to be held responsible for their actions.

Question 16

Proactive not reactive approach

Answer 16

Proactive security hardening is a preventative approach implemented before threats materialize, whereas reactive security is a response to an ongoing or past security incident.

Question 17

Embed privacy into design

Answer 17

Prioritize privacy considerations from the outset of the development lifecycle.

Question 18

Respect for user privacy

Answer 18

Prioritizing user data protection and control throughout the software development lifecycle.

Question 19

Broken authentication and session management

Answer 19

Critical security vulnerabilities in software architecture, particularly in web applications.

Question 20

cross-site request forgery (csrf)

Answer 20

Cross-Site Request Forgery (CSRF) is a type of web security vulnerability where an attacker tricks a user into performing unwanted actions on a website where they are already authenticated

Question 21

Cross-site scripting (XSS)

Answer 21

Cross-site scripting (XSS) is a web security vulnerability that allows attackers to inject malicious scripts into otherwise trusted websites.