Software Development Security (ch 20-21)

Question 1

What are the stages of the Software Capability Maturity Model?

Answer 1

Level 1: Initial (disorganized, little or no defined process)
Level 2: Repeatable
Level 3: Defined
Level 4: Managed
Level 5: Optimizing

Question 2

What are the stages of the IDEAL model?

Answer 2

Initiating
Diagnosing
Establishing
Acting
Learning

Question 3

What character, if eliminated from all web form input, would prevent the execution of many cross-site scripting attacks?

Answer 3

Cross-site scripting attacks pass the tag to a browser. Preventing the use of the < character blocks most attempts to perform these attacks, although they are still possible when using obfuscation techniques.

Question 4

What is the most common programmer-generated security flaw?

Answer 4

By far, the buffer overflow is the most common, and most avoidable, programmer-generated vulnerability.