Week 5 Flashcards
(18 cards)
Why is software difficult to secure?
It’s often under-resourced and security is added as an afterthought, making it vulnerable to attacks.
What is the Common Weakness Enumeration (CWE)?
A community-driven list of software security vulnerabilities maintained by MITRE.
What is the OWASP Top 10?
A list of the 10 most critical web application security risks identified by the Open Web Application Security Project.
When should security requirements be defined?
At the requirement specification stage, not added later.
Name three components of secure software development.
Defensive coding, functional testing, backup & data security.
Why is secure development everyone’s concern?
All developers play a role in ensuring code quality, repository protection, and secure deployment.
What is Cross-Site Scripting (XSS)?
Injection of malicious scripts into trusted web pages viewed by other users.
Name the two main types of XSS.
Reflected (non-persistent) and Stored (persistent) XSS.
Give one XSS prevention technique.
Escape untrusted data before inserting it into HTML, JS, or CSS.
What is SQL Injection?
Injection of SQL commands via unsanitized input, modifying database queries.
What are the four risk control strategies?
Avoid, Accept, Refuse, Transfer.
What does patching do?
Fixes software bugs to remove vulnerabilities, preventing exploitation.
What is the purpose of change control?
To manage risks when modifying software, reducing introduction of new flaws.
What is the difference between certification and accreditation?
Certification confirms a product/system meets requirements; Accreditation recognises the certifying body.
When is accredited certification typically mandated?
For safety - or security - critical systems.
What does ISO 27000 require regarding environments?
Separation of live and development systems.
Name one way to secure a development environment.
Run training and testing in non-live systems.
What should security testing include?
Defensive code effectiveness, malware protection, backups, access control, and resilience.
